From d0394493308e0e4a604ebde2083d06044317c858 Mon Sep 17 00:00:00 2001 From: Thomas Stromberg Date: Thu, 2 Feb 2023 19:50:13 -0500 Subject: [PATCH] Add new Kolide signing authority as a valid talker --- detection/c2/unexpected-talkers-macos.sql | 1 + 1 file changed, 1 insertion(+) diff --git a/detection/c2/unexpected-talkers-macos.sql b/detection/c2/unexpected-talkers-macos.sql index 1b0dc43..38ce984 100644 --- a/detection/c2/unexpected-talkers-macos.sql +++ b/detection/c2/unexpected-talkers-macos.sql @@ -159,6 +159,7 @@ WHERE '443,6,0,com.apple.NRD.UpdateBrainService,com.apple.NRD.UpdateBrainService,Software Signing', '443,6,0,Install,com.adobe.Install,Developer ID Application: Adobe Inc. (JQ525L2MZD)', '443,6,0,launcher,launcher,Developer ID Application: Kolide Inc (YZ3EM74M78)', + '443,6,0,launcher,com.kolide.agent,Developer ID Application: Kolide, Inc (X98UFR7HA3)', '443,6,0,nessusd,nessusd,Developer ID Application: Tenable, Inc. (4B8J598M7U)', '443,6,0,nix,nix,', '443,6,0,OneDrivePkgTelemetry,com.microsoft.OneDrivePkgTelemetry,Developer ID Application: Microsoft Corporation (UBF8T346G9)',