RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-16 17:37:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #310 from tstromberg/fpr-sep18

Browse Source 
unexpected talker events: address easy false positives
This commit is contained in:
Thomas Strömberg 2023-09-19 17:48:09 -04:00 committed by GitHub
commit ddb37c066a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
detection/c2/unexpected-talker-events.sql
View File

@ -82,8 +82,11 @@ WHERE
'/Library/Application Support',
'/Library/Kandji',
'/System/Volumes',
'~/bin',
'/usr/local',
'/opt/homebrew',
'~/Apps',
'~/code',
'~/work',
'~/github',
'~/src',
@ -97,8 +100,10 @@ WHERE
AND NOT exception_key IN (
'500,0,123,sntp',
'500,0,22,ssh',
'500,0,443,velociraptor',
'500,0,32768,ksfetch',
'500,500,32768,ksfetch',
'500,500,443,old',
'500,0,32768,syncthing',
'500,0,443,chrome',
'500,0,443,curl',
@ -107,11 +112,18 @@ WHERE
'500,0,443,launcher',
'500,0,443,slack',
'500,0,31488,sntp',
'500,500,443,go',
'500,0,443,syncthing',
'500,0,443,wget',
'500,0,5228,chrome',
'500,0,53,chrome',
'500,0,53,git',
'500,0,443,firefox',
'500,0,80,firefox',
'500,0,443,node',
'500,500,2304,cloud_sql_proxy',
'500,500,443,cloud_sql_proxy',
'500,500,80,cloud_sql_proxy',
'500,0,53,launcher',
'500,0,53,NetworkManager',
'500,0,53,slack',