Merge pull request #15 from chainguard-dev/false-positives-npm-exec

linux https clients: Add exception for npm exec
2022-10-20 14:16:14 -04:00 · 2022-10-20 14:16:14 -04:00 · c8bf0265eb
parent 8b16ce2aa4 905046cd2a
commit c8bf0265eb
1 changed files with 1 additions and 0 deletions
--- a/detection/c2/unexpected-https-client-linux.sql
+++ b/detection/c2/unexpected-https-client-linux.sql
@ -94,5 +94,6 @@ WHERE
    '500,/usr/syncthing,0u,0g,syncthing'
  ) -- stay weird, NixOS (Fastly nix mirror)
  AND NOT child_cmd = '/run/current-system/sw/bin/bash'
+  AND NOT exception_key LIKE '500,/usr/node,0u,0g,npm exec %'
 GROUP BY
  p.cmdline