RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-25 06:42:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #65 from tstromberg/main

Browse Source 
Add karabiner_session_monitor exception
This commit is contained in:
Thomas Strömberg 2022-11-04 09:58:49 -04:00 committed by GitHub
commit c1b3ee131f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
detection/privesc/unexpected-setxid-process.sql
View File

@ -25,21 +25,22 @@ FROM
WHERE
f.mode NOT LIKE '0%'
AND f.path NOT IN (
'/Applications/Parallels Desktop.app/Contents/MacOS/Parallels Service',
'/bin/ps',
'/Library/Application Support/org.pqrs/Karabiner-Elements/bin/karabiner_session_monitor',
'/Library/DropboxHelperTools/Dropbox_u501/dbkextd',
'/opt/1Password/1Password-BrowserSupport',
'/opt/1Password/1Password-KeyringHelper',
'/usr/bin/doas',
'/usr/lib/xf86-video-intel-backlight-helper',
'/usr/bin/mount',
'/usr/bin/fusermount',
'/usr/bin/fusermount3',
'/usr/sbin/traceroute',
'/usr/bin/login',
'/usr/bin/mount',
'/usr/bin/ssh-agent',
'/usr/bin/su',
'/Applications/Parallels Desktop.app/Contents/MacOS/Parallels Service',
'/usr/bin/sudo',
'/usr/bin/top',
'/usr/lib/Xorg.wrap'
'/usr/lib/xf86-video-intel-backlight-helper',
'/usr/lib/Xorg.wrap',
'/usr/sbin/traceroute'
);