RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2024-12-13 17:44:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #28 from tstromberg/false-positives-again2

Browse Source 
linux talkers: Add another firefox & chainctl exception
This commit is contained in:
Thomas Strömberg 2022-10-21 17:46:40 -04:00 committed by GitHub
commit e643bf4ab0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
detection/c2/unexpected-https-client-linux.sql
View File

@ -70,12 +70,13 @@ WHERE
'0,/usr/nix,0u,0g,nix',
'0,/usr/packagekitd,0u,0g,packagekitd',
'0,/usr/pacman,0u,0g,pacman',
'0,/usr/python3.10,0u,0g,dnf',
'0,/usr/tailscaled,0u,0g,tailscaled',
'0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra',
'500,/app/slack,u,g,slack',
'500,/app/thunderbird,u,g,thunderbird',
'500,/app/zoom.real,u,g,zoom.real',
'0,/usr/python3.10,0u,0g,dnf',
'500,/home/chainctl,500u,100g,chainctl',
'500,/home/chainctl,500u,500g,chainctl',
'500,/home/gitsign,500u,500g,gitsign',
'500,/home/go,500u,500g,go',

1
detection/c2/unexpected-talkers-linux.sql
View File

@ -100,6 +100,7 @@ WHERE
'80,6,500,/usr/chrome,0u,0g,chrome',
'80,6,500,/usr/curl,0u,0g,curl',
'80,6,500,/usr/firefox,0u,0g,firefox',
'80,6,500,/usr/firefox,0u,0g,.firefox-wrappe',
'8080,6,500,/opt/chrome,0u,0g,chrome',
'8080,6,500,/usr/firefox,0u,0g,firefox',
'8443,6,500,/opt/chrome,0u,0g,chrome',