Merge pull request #295 from tstromberg/process-ext

netutil calls: add nscurl
2023-07-12 16:45:49 -04:00 · 2023-07-12 16:45:49 -04:00 · 6182f2957e
parent edbe3fa1f6 8e73ef70d2
commit 6182f2957e
1 changed files with 1 additions and 0 deletions
--- a/detection/discovery/unexpected-netutil-calls-macos.sql
+++ b/detection/discovery/unexpected-netutil-calls-macos.sql
@ -77,6 +77,7 @@ WHERE
  pe.path IN (
    '/sbin/ifconfig',
    '/usr/sbin/netstat',
+    '/usr/bin/nscurl',
    '/sbin/pfctl',
    '/usr/libexec/ApplicationFirewall/socketfilterfw'
  )