diff --git a/detection/c2/unexpected-talkers-macos.sql b/detection/c2/unexpected-talkers-macos.sql index 8a0d78d..bfb1f71 100644 --- a/detection/c2/unexpected-talkers-macos.sql +++ b/detection/c2/unexpected-talkers-macos.sql @@ -109,4 +109,8 @@ WHERE pos.pid IN ( ) AND p0.path LIKE '/opt/homebrew/Cellar/podman/%/libexec/podman/gvproxy' ) + AND NOT ( + unsigned_exception = '500,0,0,chainlink,chainlink' + AND p0.path LIKE '/var/folders/%/T/go-build%/b001/exe/chainlink' + ) GROUP BY p0.cmdline