RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-16 01:17:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #3 from chainguard-dev/false-positives

Browse Source 
Add talker exceptions for curl, firefox, chrome, git-remote-http
This commit is contained in:
Thomas Strömberg 2022-10-20 13:14:16 -04:00 committed by GitHub
commit e6a60ea1db
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
detection/c2/unexpected-https-client-linux.sql
View File

@ -73,6 +73,8 @@ WHERE
'500,/ko-app/controlplane,u,g,controlplane',
'500,/opt/chrome,0u,0g,chrome',
'500,/opt/spotify,0u,0g,spotify',
'500,/snap/firefox,0u,0g,firefox',
'500,/usr/curl,0u,0g,curl',
'500,/usr/chrome,0u,0g,chrome',
'500,/usr/code,0u,0g,code',
'500,/usr/firefox,0u,0g,firefox',

4
detection/c2/unexpected-talkers-linux.sql
View File

@ -84,14 +84,16 @@ WHERE
'22000,6,500,/usr/syncthing,0u,0g,syncthing',
'4070,6,500,/opt/spotify,0u,0g,spotify',
'5228,6,500,/opt/chrome,0u,0g,chrome',
'5228,6,500,/usr/chrome,0u,0g,chrome', -- Android Market/GCM
'8000,6,500,/opt/chrome,0u,0g,chrome',
'8000,6,500,/usr/firefox,0u,0g,firefox',
'80,6,0,/usr/NetworkManager,0u,0g,NetworkManager', -- fedoraproject.org
'80,6,0,/usr/tailscaled,0u,0g,tailscaled',
'80,6,0,/usr/.tailscaled-wrapped,0u,0g,.tailscaled-wra',
'80,6,500,/opt/chrome,0u,0g,chrome',
'80,6,500,/snap/firefox,0u,0g,firefox',,
'80,6,500,/usr/curl,0u,0g,curl',
'80,6,500,/usr/firefox,0u,0g,firefox',
'5228,6,500,/usr/chrome,0u,0g,chrome', -- Android Market/GCM
'8080,6,500,/opt/chrome,0u,0g,chrome',
'8080,6,500,/usr/firefox,0u,0g,firefox',
'8443,6,500,/opt/chrome,0u,0g,chrome',

1
detection/c2/unexpected-talkers-macos.sql
View File

@ -177,6 +177,7 @@ WHERE
'443,6,500,gh,gh,',
'443,6,500,git,com.apple.git,Software Signing',
'443,6,500,git,git,',
'443,6,500,git-remote-http,,',
'443,6,500,git-remote-http,com.apple.git-remote-http,Software Signing',
'443,6,500,git-remote-http,git-remote-http-5555494493930c47f9d9385e94cdee8b19968153,',
'443,6,500,git-remote-http,git-remote-http-55554944ce011d0e889a3cf58e5ac97ac15728f3,',