RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-10 07:39:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add exception for Discord

Browse Source
This commit is contained in:
Thomas Stromberg 2022-11-03 16:02:45 -04:00
parent f2a9e785fe
commit e650ab6abc
Failed to extract signature
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
detection/c2/unexpected-https-client-linux.sql
View File

@ -65,7 +65,9 @@ WHERE
AND p.path != ''
AND NOT exception_key IN (
'0,/opt/snapd,0u,0g,snapd',
'0,/sbin/apk,u,g,apk',
'0,/usr/bash,0u,0g,mkinitcpio',
'0,/usr/cmake,u,g,cmake',
'0,/usr/containerd,u,g,containerd',
'0,/usr/dockerd,0u,0g,dockerd',
'0,/usr/flatpak-system-helper,0u,0g,flatpak-system-',
@ -99,12 +101,15 @@ WHERE
'500,/opt/1password,0u,0g,1password',
'500,/opt/Brackets,0u,0g,Brackets',
'500,/opt/chrome,0u,0g,chrome',
'500,/opt/Discord,0u,0g,Discord',
'500,/opt/firefox,0u,0g,firefox',
'500,/opt/firefox,0u,0g,Socket Process',
'500,/opt/kubectl,0u,0g,kubectl',
'500,/opt/slack,0u,0g,slack',
'500,/opt/spotify,0u,0g,spotify',
'500,/tmp/jetbrains-toolbox,u,g,jetbrains-toolb',
'500,/usr/abrt-action-generate-core-backtrace,0u,0g,abrt-action-gen',
'500,/usr/bom,500u,500g,bom',
'500,/usr/cargo,0u,0g,cargo',
'500,/usr/chainctl,0u,0g,chainctl',
'500,/usr/chrome,0u,0g,chrome',
@ -125,14 +130,10 @@ WHERE
'500,/usr/gnome-software,0u,0g,gnome-software',
'500,/usr/go,0u,0g,go',
'500,/usr/go,500u,500g,go',
'500,/tmp/jetbrains-toolbox,u,g,jetbrains-toolb',
'500,/usr/gsd-datetime,0u,0g,gsd-datetime',
'0,/sbin/apk,u,g,apk',
'500,/usr/gvfsd-http,0u,0g,gvfsd-http',
'0,/usr/cmake,u,g,cmake',
'500,/usr/java,0u,0g,java',
'500,/usr/kubectl,500u,500g,kubectl',
'500,/usr/bom,500u,500g,bom',
'500,/usr/rpi-imager,0u,0g,rpi-imager',
'500,/usr/signal-desktop,0u,0g,signal-desktop',
'500,/usr/slack,0u,0g,slack',