RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-25 14:30:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Reduce false positives

Browse Source
This commit is contained in:
Thomas Stromberg 2022-10-20 08:04:24 -04:00
parent 152887f8d8
commit 7de03e7fbc
Failed to extract signature
3 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
detection/c2/unexpected-talkers-linux.sql
View File

@ -77,12 +77,20 @@ WHERE protocol > 0
AND s.remote_address NOT LIKE 'fc00:%'
AND p.path != ''
AND NOT exception_key IN (
'80,6,0,/usr/tailscaled,0u,0g,tailscaled',
'5228,6,500,/opt/chrome,0u,0g,chrome',
'4070,6,500,/opt/spotify,0u,0g,spotify',
'22000,6,500,/usr/syncthing,0u,0g,syncthing',
'123,17,500,/usr/chronyd,0u,0g,chronyd',
'22000,6,500,/usr/syncthing,0u,0g,syncthing',
'4070,6,500,/opt/spotify,0u,0g,spotify',
'5228,6,500,/opt/chrome,0u,0g,chrome',
'80,6,0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra'
'80,6,0,/usr/tailscaled,0u,0g,tailscaled',
'80,6,500,/opt/chrome,0u,0g,chrome',
'80,6,500,/usr/firefox,0u,0g,firefox',
'8000,6,500,/opt/chrome,0u,0g,chrome',
'8000,6,500,/usr/firefox,0u,0g,firefox',
'8080,6,500,/opt/chrome,0u,0g,chrome',
'8080,6,500,/usr/firefox,0u,0g,firefox',
'8443,6,500,/opt/chrome,0u,0g,chrome',
'8443,6,500,/usr/firefox,0u,0g,firefox',
)
AND NOT (
p.name = 'syncthing'

2
detection/execution/sketchy-fetcher-events.sql
View File

@ -46,7 +46,7 @@ WHERE
OR p.cmdline LIKE '%curl.*—write-out%'
OR p.cmdline LIKE '%curl %--user-agent%'
OR p.cmdline LIKE '%curl -k%'
OR p.cmdline LIKE '%curl -sL%'
OR p.cmdline LIKE '%curl -sL %'
OR p.cmdline LIKE '%curl%--connect-timeout%'
OR p.cmdline LIKE '%curl%--output /dev/null%'
OR p.cmdline LIKE '%curl%--O /dev/null%'

2
detection/execution/sketchy-fetcher.sql
View File

@ -40,7 +40,7 @@ WHERE
OR p.cmdline LIKE '%pastebin%'
OR p.cmdline LIKE '%curl %--user-agent%'
OR p.cmdline LIKE '%curl -k%'
OR p.cmdline LIKE '%curl -sL%'
OR p.cmdline LIKE '%curl -sL %'
OR p.cmdline LIKE '%curl%--insecure%'
OR p.cmdline LIKE '%wget %--user-agent%'
OR p.cmdline LIKE '%wget %--no-check-certificate%'