RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-10 15:49:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #55 from tstromberg/fp44

Browse Source 
talkers-macos: Fix typo in protocol field name
This commit is contained in:
Thomas Strömberg 2022-11-01 07:20:29 -04:00 committed by GitHub
commit bdd13408bb
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/c2/unexpected-talkers-macos.sql
View File

@ -72,7 +72,7 @@ WHERE
AND NOT ( AND NOT (
signature.identifier LIKE 'com.apple.%' AND signature.authority = 'Software Signing' signature.identifier LIKE 'com.apple.%' AND signature.authority = 'Software Signing'
AND remote_port IN (53,443,80) AND remote_port IN (53,443,80)
AND remote_protocol IN (6, 17) AND protocol IN (6, 17)
) )
AND NOT ( AND NOT (
remote_port = 53 remote_port = 53