Add exceptions for /Library/Python and /Library/Caches/.0%

2022-10-20 13:14:37 -04:00 · 2022-10-20 13:14:37 -04:00 · 8e1569164a
parent a973dcbcf2
commit 8e1569164a
1 changed files with 2 additions and 1 deletions
--- a/detection/evasion/unexpected-library-entries-macos.sql
+++ b/detection/evasion/unexpected-library-entries-macos.sql
@ -93,6 +93,7 @@ WHERE
    '/Library/Preferences/.GlobalPreferences.plist',
    '/Library/Printers/',
    '/Library/PrivilegedHelperTools/',
+    '/Library/Python/',
    '/Library/QuickLook/',
    '/Library/Receipts/',
    '/Library/Ruby/',
@ -122,4 +123,4 @@ WHERE
    '/Library/WebServer/Documents/index.html.en',
    '/Library/WebServer/share/'
  )
-  AND NOT file.path LIKE '/Library/Caches/.00%'
+  AND NOT file.path LIKE '/Library/Caches/.0%'