RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add port 19305 (Google Meet) on Firefox

This commit is contained in:
Thomas Stromberg 2023-01-19 12:18:22 -05:00
parent 67fb9cad14
commit b601d6c3b0
Failed to extract signature
1 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
detection/c2/unexpected-talkers-linux.sql
View File

@ -88,6 +88,7 @@ WHERE
'123,17,500,/usr/chronyd,0u,0g,chronyd', '123,17,500,/usr/chronyd,0u,0g,chronyd',
'143,6,500,/app/thunderbird,u,g,thunderbird', '143,6,500,/app/thunderbird,u,g,thunderbird',
'143,6,500,/usr/thunderbird,0u,0g,thunderbird', '143,6,500,/usr/thunderbird,0u,0g,thunderbird',
'19305,6,500,/usr/firefox,0u,0g,firefox',
'22000,6,500,/usr/syncthing,0u,0g,syncthing', '22000,6,500,/usr/syncthing,0u,0g,syncthing',
'22,6,0,/usr/ssh,0u,0g,ssh', '22,6,0,/usr/ssh,0u,0g,ssh',
'22,6,0,/usr/tailscaled,0u,0g,tailscaled', '22,6,0,/usr/tailscaled,0u,0g,tailscaled',
@ -119,9 +120,8 @@ WHERE
'80,6,0,/usr/bash,0u,0g,mkinitcpio', '80,6,0,/usr/bash,0u,0g,mkinitcpio',
'80,6,0,/usr/bash,0u,0g,sh', '80,6,0,/usr/bash,0u,0g,sh',
'80,6,0,/usr/bash,0u,0g,update-ca-trust', '80,6,0,/usr/bash,0u,0g,update-ca-trust',
'80,6,100,/usr/http,0u,0g,http', '80,6,0,/usr/cp,0u,0g,cp',
'80,6,0,/usr/gpg,0u,0g,gpg', '80,6,0,/usr/gpg,0u,0g,gpg',
'88,6,500,/usr/syncthing,0u,0g,syncthing',
'80,6,0,/usr/kubelet,u,g,kubelet', '80,6,0,/usr/kubelet,u,g,kubelet',
'80,6,0,/usr/NetworkManager,0u,0g,NetworkManager', '80,6,0,/usr/NetworkManager,0u,0g,NetworkManager',
'80,6,0,/usr/packagekitd,0u,0g,packagekitd', '80,6,0,/usr/packagekitd,0u,0g,packagekitd',
@ -131,10 +131,10 @@ WHERE
'80,6,0,/usr/python3.10,0u,0g,yum', '80,6,0,/usr/python3.10,0u,0g,yum',
'80,6,0,/usr/python3.11,0u,0g,dnf', '80,6,0,/usr/python3.11,0u,0g,dnf',
'80,6,0,/usr/python3.11,0u,0g,yum', '80,6,0,/usr/python3.11,0u,0g,yum',
'80,6,0,/usr/cp,0u,0g,cp',
'80,6,0,/usr/tailscaled,0u,0g,tailscaled', '80,6,0,/usr/tailscaled,0u,0g,tailscaled',
'80,6,0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra', '80,6,0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra',
'80,6,0,/usr/wget,0u,0g,wget', '80,6,0,/usr/wget,0u,0g,wget',
'80,6,100,/usr/http,0u,0g,http',
'80,6,105,/usr/http,0u,0g,http', '80,6,105,/usr/http,0u,0g,http',
'80,6,500,/app/signal-desktop,u,g,signal-desktop', '80,6,500,/app/signal-desktop,u,g,signal-desktop',
'80,6,500,/app/spotify,u,g,spotify', '80,6,500,/app/spotify,u,g,spotify',
@ -167,6 +167,7 @@ WHERE
'8443,6,500,/usr/firefox,0u,0g,firefox', '8443,6,500,/usr/firefox,0u,0g,firefox',
'8801,17,500,/app/zoom.real,u,g,zoom.real', '8801,17,500,/app/zoom.real,u,g,zoom.real',
'8801,17,500,/opt/zoom,0u,0g,zoom', '8801,17,500,/opt/zoom,0u,0g,zoom',
'88,6,500,/usr/syncthing,0u,0g,syncthing',
'993,6,500,/app/thunderbird,u,g,thunderbird', '993,6,500,/app/thunderbird,u,g,thunderbird',
'993,6,500,/usr/evolution,0u,0g,evolution', '993,6,500,/usr/evolution,0u,0g,evolution',
'993,6,500,/usr/thunderbird,0u,0g,thunderbird' '993,6,500,/usr/thunderbird,0u,0g,thunderbird'