RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #323 from tstromberg/fpr-sep26 

Broaden the talker exception list
This commit is contained in:
Thomas Strömberg 2023-09-26 16:42:13 -04:00 committed by GitHub
parent a6c065200c ed473f438d
commit d6fc3e09cd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 17 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
detection/c2/unexpected-talker-events.sql
View File

@ -99,16 +99,19 @@ WHERE
'~/work' '~/work'
) )
AND NOT exception_key IN ( AND NOT exception_key IN (
'500,0,110,syncthing',
'500,0,123,sntp', '500,0,123,sntp',
'500,0,443,com.google.one.NetworkExtension',
'500,0,22,ssh', '500,0,22,ssh',
'500,0,443,com.apple.NRD.UpdateBrainService',
'500,0,31488,sntp', '500,0,31488,sntp',
'500,0,32768,ksfetch', '500,0,32768,ksfetch',
'500,0,32768,syncthing', '500,0,32768,syncthing',
'500,0,443,OneDriveStandaloneUpdater',
'500,0,443,chrome', '500,0,443,chrome',
'500,0,443,com.apple.NRD.UpdateBrainService',
'500,0,443,com.google.one.NetworkExtension',
'500,0,443,curl', '500,0,443,curl',
'500,0,443,firefox', '500,0,443,firefox',
'500,0,443,fwupdmgr',
'500,0,443,git-remote-http', '500,0,443,git-remote-http',
'500,0,443,ksfetch', '500,0,443,ksfetch',
'500,0,443,launcher', '500,0,443,launcher',
@ -119,14 +122,15 @@ WHERE
'500,0,443,velociraptor', '500,0,443,velociraptor',
'500,0,443,wget', '500,0,443,wget',
'500,0,5228,chrome', '500,0,5228,chrome',
'500,0,53,NetworkManager',
'500,0,53,chrome', '500,0,53,chrome',
'500,0,53,git', '500,0,53,git',
'500,0,53,launcher', '500,0,53,launcher',
'500,0,53,NetworkManager',
'500,0,53,slack', '500,0,53,slack',
'500,0,53,wget', '500,0,53,wget',
'500,0,80,chrome', '500,0,80,chrome',
'500,0,80,firefox', '500,0,80,firefox',
'500,0,80,http',
'500,0,9,launcher', '500,0,9,launcher',
'500,500,13568,Code Helper', '500,500,13568,Code Helper',
'500,500,22,ssh', '500,500,22,ssh',
@ -134,34 +138,31 @@ WHERE
'500,500,32768,cloud-sql-proxy', '500,500,32768,cloud-sql-proxy',
'500,500,32768,ksfetch', '500,500,32768,ksfetch',
'500,500,4318,Code Helper (Plugin)', '500,500,4318,Code Helper (Plugin)',
'500,500,80,Code Helper (Plugin)',
'500,500,443,aws',
'500,500,443,cloud_sql_proxy',
'500,500,443,Code Helper (Plugin)', '500,500,443,Code Helper (Plugin)',
'500,500,443,Code Helper', '500,500,443,Code Helper',
'500,500,443,grype', '500,500,443,DropboxMacUpdate',
'500,500,443,copilot-agent-macos-arm64',
'500,500,443,Electron', '500,500,443,Electron',
'500,500,443,chainctl',
'500,0,80,http',
'500,500,443,figma_agent',
'500,0,443,fwupdmgr',
'500,500,443,GitX', '500,500,443,GitX',
'500,0,110,syncthing', '500,500,443,aws',
'500,500,80,Code Helper (Plugin)', '500,500,443,chainctl',
'500,500,80,ksfetch', '500,500,443,cloud_sql_proxy',
'500,500,443,copilot-agent-macos-arm64',
'500,500,443,figma_agent',
'500,500,443,gitsign', '500,500,443,gitsign',
'500,500,443,go', '500,500,443,go',
'500,0,443,OneDriveStandaloneUpdater', '500,500,443,grype',
'500,500,443,ksfetch', '500,500,443,ksfetch',
'500,500,443,node', '500,500,443,node',
'500,500,443,old', '500,500,443,old',
'500,500,443,wolfictl', '500,500,443,wolfictl',
'500,500,80,Code Helper (Plugin)',
'500,500,80,cloud_sql_proxy', '500,500,80,cloud_sql_proxy',
'500,500,80,copilot-agent-macos-arm64', '500,500,80,copilot-agent-macos-arm64',
'500,500,80,ksfetch',
'500,500,80,node' '500,500,80,node'
) )
AND NOT exception_key LIKE '500,500,443,terraform%' AND NOT exception_key LIKE '500,500,443,terraform%'
AND NOT exception_key LIKE '500,0,%,syncthing'
AND NOT exception_key LIKE '500,0,%,chrome' AND NOT exception_key LIKE '500,0,%,chrome'
AND NOT ( AND NOT (
basename = "Python" basename = "Python"