Add Tailscale/Cisco

2024-10-21 10:19:07 -04:00 · 2024-10-21 10:19:07 -04:00 · 69850c42af
parent e22dcbf0ee
commit 69850c42af
1 changed files with 2 additions and 0 deletions
--- a/detection/c2/unexpected-talkers-macos.sql
+++ b/detection/c2/unexpected-talkers-macos.sql
@ -89,7 +89,9 @@ WHERE pos.pid IN (
  AND p0.path NOT LIKE '/usr/sbin/%'
  AND p0.path NOT LIKE '/usr/libexec/%'
  AND NOT signed_exception IN (
+    '0,Developer ID Application: Tailscale Inc. (W5364U7YZB)',
    '500,Apple Mac OS Application Signing',
+    '500,Developer ID Application: Cisco (DE8Y96K9QP)',
    '500,Developer ID Application: Google LLC (EQHXZ8M8AV)'
  )
  AND NOT exception_key IN (