Additional fixes for Ventura & Capture One

detection/evasion/hidden-home-libappsupport.sql

@@ -82,10 +82,10 @@ WHERE
   -- Capture One
   AND NOT (
     file.mode = "0666"
-    AND size > 2000
+    AND size > 1200
     AND size < 4000
     AND REGEX_MATCH (
-      ".085520434CB685DE008C8DBAB6A46215",
+      file.filename,
       "^(\.[0-9A-Z]{32})$",
       0
     ) != ""

detection/evasion/hidden-home-library-dir.sql

@@ -39,6 +39,9 @@ WHERE
     '~/Library/Accessibility/.com.apple.RTTTranscripts_SUPPORT/_EXTERNAL_DATA',
     '~/Library/Finance/.finance_cloud_SUPPORT/_EXTERNAL_DATA',
     '~/Library/Finance/.finance_local_SUPPORT/_EXTERNAL_DATA',
+    '~/Library/com.apple.groupkitd/.syncedGroupStore_SUPPORT/_EXTERNAL_DATA',
+    '~/Library/Finance/.finance_dropbox_SUPPORT/_EXTERNAL_DATA',
+    '~/Library/com.apple.groupkitd/.syncedGroupStore_SUPPORT/_EXTERNAL_DATA/',
     '~/Library/Preferences/.wrangler',
     '~/Library/Group Containers/.SiriTodayViewExtension/Library',
     '~/Library/Group Containers/.SiriTodayViewExtension',

detection/evasion/unexpected-user-shared-entries.sql

@@ -50,6 +50,7 @@ WHERE
       '/Users/Shared/.DS_Store',
       '/Users/Shared/.ks.intego_metrics_2.plist',
       '/Users/Shared/.localized',
+      '/Users/Shared/.userfonts.cachedb',
       '/Users/Shared/CleanMyMac X/.licence',
       '/Users/Shared/LogiTuneInstallerStarted.txt',
       '/Users/Shared/.NSVolumeHeap',

detection/execution/recently-created-executables-long-lived-macos.sql

@@ -190,7 +190,7 @@ WHERE
     'Software Signing'
   )
   AND NOT (
-    s.id = "com.apple.print.PrinterProxy"
+    s.identifier = "com.apple.print.PrinterProxy"
     AND p0.path LIKE "/Users/%/Library/Printers/%/Contents/MacOS/PrinterProxy"
     AND p0.uid > 499
   )

detection/initial_access/unexpected-diskimage-source-macos.sql

@@ -9,7 +9,7 @@
 --   * disk images downloaded from a location not in the exception list
 --
 -- platform: darwin
--- tags: persistent filesystem spotlight
+-- tags: persistent filesystem spotlight often
 SELECT
   file.path,
   file.size,
@@ -130,6 +130,7 @@ WHERE
     'arc.net',
     'presenting.app',
     'adoptium.net',
+    'mimestream.com',
     'balsamiq.com',
     'bearly.ai',
     'brave.com',