RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-10 07:39:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #50 from tstromberg/oflow

Browse Source 
talkers/listeners: Add exceptions for Steam & Java
This commit is contained in:
Thomas Strömberg 2022-10-30 10:06:30 -04:00 committed by GitHub
commit cc6ee777c2
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
detection/c2/unexpected-listening-port-macos.sql
View File

@ -87,6 +87,7 @@ WHERE
'49152,6,500,com.docker.backend,Developer ID Application: Docker Inc (9BNSXJN65R)',
'49152,6,500,GarageBand,Apple Mac OS Application Signing',
'49152,6,500,IPNExtension,Apple Mac OS Application Signing',
'49152,6,500,java,Developer ID Application: Eclipse Foundation, Inc. (JCDTMS22B4)',
'49152,6,500,java,Developer ID Application: Oracle America, Inc. (VB5E2TV963)',
'49152,6,500,jetbrains-toolbox,Developer ID Application: JetBrains s.r.o. (2ZEFAR8TH3)',
'49152,6,500,LogiMgrDaemon,Developer ID Application: Logitech Inc. (QED4VVPZWA)',

1
detection/c2/unexpected-talkers-linux.sql
View File

@ -103,6 +103,7 @@ WHERE
'80,6,0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra',
'80,6,105,/usr/http,0u,0g,http',
'80,6,500,/app/thunderbird,u,g,thunderbird',
'80,6,500,/home/steam,500u,100g,steam',
'80,6,500,/opt/chrome,0u,0g,chrome',
'80,6,500,/opt/firefox,0u,0g,firefox',
'80,6,500,/usr/chrome,0u,0g,chrome',