RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-27 07:20:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

whitelist more launchd entries

Browse Source
This commit is contained in:
Thomas Stromberg 2022-09-13 21:25:04 -04:00
parent a512597ace
commit 8e05e69465
Failed to extract signature
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
startup/unexpected-launchd-program-arguments.sql
View File

@ -22,6 +22,7 @@ WHERE (
AND l.path NOT LIKE "/System/%" AND l.path NOT LIKE "/System/%"
AND program_authority NOT IN ( AND program_authority NOT IN (
'Developer ID Application: Adobe Inc. (JQ525L2MZD)', 'Developer ID Application: Adobe Inc. (JQ525L2MZD)',
'Developer ID Application: Corsair Memory, Inc. (Y93VXCB8Q5)',
'Developer ID Application: Foxit Corporation (8GN47HTP75)', 'Developer ID Application: Foxit Corporation (8GN47HTP75)',
'Developer ID Application: Google LLC (EQHXZ8M8AV)', 'Developer ID Application: Google LLC (EQHXZ8M8AV)',
'Developer ID Application: Keybase, Inc. (99229SGT5K)', 'Developer ID Application: Keybase, Inc. (99229SGT5K)',
@ -31,10 +32,15 @@ WHERE (
'Developer ID Application: Mersive Technologies (63B5A5WDNG)', 'Developer ID Application: Mersive Technologies (63B5A5WDNG)',
'Developer ID Application: Microsoft Corporation (UBF8T346G9)', 'Developer ID Application: Microsoft Corporation (UBF8T346G9)',
'Developer ID Application: Proton Technologies AG (6UN54H93QT)', 'Developer ID Application: Proton Technologies AG (6UN54H93QT)',
'Developer ID Application: Seiko Epson Corporation (TXAEAV5RN4)',
'Software Signing', 'Software Signing',
'yabai-cert' 'yabai-cert'
) )
AND program_arguments NOT IN ('/opt/homebrew/opt/skhd/bin/skhd') AND program_arguments NOT IN (
'/opt/homebrew/opt/skhd/bin/skhd',
'/usr/local/MacGPG2/libexec/fixGpgHome'
)
AND program_arguments NOT LIKE '/Users/%/Library/Application Support/com.grammarly.ProjectLlama/Scripts/post-uninstall.sh' AND program_arguments NOT LIKE '/Users/%/Library/Application Support/com.grammarly.ProjectLlama/Scripts/post-uninstall.sh'
AND program_arguments NOT LIKE '/Users/%/homebrew/opt/mysql/bin/mysqld_safe --datadir=/Users/%/homebrew/var/mysql'

3
startup/unexpected-launchd-program.sql
View File

@ -23,4 +23,7 @@ WHERE (
'Developer ID Application: Microsoft Corporation (UBF8T346G9)', 'Developer ID Application: Microsoft Corporation (UBF8T346G9)',
'Developer ID Application: Valve Corporation (MXGJJ98X76)', 'Developer ID Application: Valve Corporation (MXGJJ98X76)',
'Developer ID Application: Wireshark Foundation, Inc. (7Z6EMTD2C6)' 'Developer ID Application: Wireshark Foundation, Inc. (7Z6EMTD2C6)'
)
AND program NOT IN (
'/usr/local/MacGPG2/libexec/shutdown-gpg-agent'
) )