RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-20 12:30:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #348 from tstromberg/rapid7-elastic-bob

Browse Source 
fpr: elastic, rapid7, zwift
This commit is contained in:
Thomas Strömberg 2024-01-10 11:21:02 -05:00 committed by GitHub
commit eaf42fbcd7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
7 changed files with 41 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
detection/c2/unexpected-talker-events.sql
View File

@ -113,11 +113,12 @@ WHERE
'500,0,1234,spotify',
'500,0,123,sntp',
'500,0,20480,io.tailscale.ipn.macsys.network-extension',
'500,0,32768,com.apple.MobileSoftwareUpdate.UpdateBrainService',
'500,0,22,ssh',
'500,0,31488,sntp',
'500,0,443,go',
'500,0,32768,com.apple.MobileSoftwareUpdate.UpdateBrainService',
'500,0,32768,com.apple.NRD.UpdateBrainService',
'500,0,32768,elastic-endpoint',
'500,500,443,ZwiftAppSilicon',
'500,0,32768,firefox',
'500,0,32768,io.tailscale.ipn.macsys.network-extension',
'500,0,32768,ksfetch',
@ -134,13 +135,16 @@ WHERE
'500,0,443,com.fortinet.forticlient.macos.vpn.nwextension',
'500,0,443,com.google.one.NetworkExtension',
'500,0,443,curl',
'500,0,443,elastic-endpoint',
'500,0,443,electron',
'500,0,443,firefox',
'500,0,443,fwupdmgr',
'500,0,443,git-remote-http',
'500,0,443,gnome-software',
'500,0,443,go',
'500,0,443,http',
'500,0,443,io.tailscale.ipn.macsys.network-extension',
'500,0,443,ir_agent',
'500,0,443,kioslave5',
'500,0,443,ksfetch',
'500,0,443,launcher',
@ -149,13 +153,11 @@ WHERE
'500,0,443,node',
'500,0,443,OneDriveStandaloneUpdater',
'500,0,443,pingsender',
'500,0,9,snapd',
'500,0,443,slack',
'500,0,443,snapd',
'500,0,443,spotify',
'500,0,443,ssh',
'500,0,443,syncthing',
'500,500,443,Acrobat Updater',
'500,0,443,velociraptor',
'500,0,443,wget',
'500,0,5228,chrome',
@ -165,13 +167,10 @@ WHERE
'500,0,53,launcher',
'500,0,53,nessusd',
'500,0,53,NetworkManager',
'500,99,32768,Slack',
'500,0,53,slack',
'500,0,53,spotify',
'500,500,32768,G2MUpdate',
'500,0,53,wget',
'500,0,5632,ssh',
'500,0,53,nessusd',
'500,0,80,chrome',
'500,0,80,com.apple.NRD.UpdateBrainService',
'500,0,80,electron',
@ -179,8 +178,8 @@ WHERE
'500,0,80,http',
'500,0,80,io.tailscale.ipn.macsys.network-extension',
'500,0,80,ksfetch',
'500,500,53,gitsign',
'500,0,9,launcher',
'500,0,9,snapd',
'500,500,13568,Code Helper',
'500,500,20480,Code Helper',
'500,500,20480,GoogleUpdater',
@ -192,14 +191,14 @@ WHERE
'500,500,32768,cloud-sql-proxy',
'500,500,32768,Code Helper',
'500,500,32768,Electron',
'500,500,32768,G2MUpdate',
'500,500,32768,GoogleUpdater',
'500,500,32768,java',
'500,99,443,Slack Helper',
'500,500,32768,ksfetch',
'500,0,32768,elastic-endpoint',
'500,500,32768,melange',
'500,500,32768,node',
'500,500,4318,Code Helper (Plugin)',
'500,500,443,Acrobat Updater',
'500,500,443,apk',
'500,500,443,aws',
'500,500,443,chainctl',
@ -224,7 +223,6 @@ WHERE
'500,500,443,istioctl',
'500,500,443,ksfetch',
'500,500,443,kubectl',
'500,99,443,Slack',
'500,500,443,minikube',
'500,500,443,node',
'500,500,443,old',
@ -233,6 +231,7 @@ WHERE
'500,500,443,syft',
'500,500,443,wolfictl',
'500,500,53,Code Helper',
'500,500,53,gitsign',
'500,500,80,cloud_sql_proxy',
'500,500,80,Code Helper',
'500,500,80,Code Helper (Plugin)',
@ -240,7 +239,10 @@ WHERE
'500,500,80,Google Chrome Helper',
'500,500,80,GoogleUpdater',
'500,500,80,ksfetch',
'500,500,80,node'
'500,500,80,node',
'500,99,32768,Slack',
'500,99,443,Slack',
'500,99,443,Slack Helper'
)
AND NOT exception_key LIKE '500,500,443,terraform%'
AND NOT exception_key LIKE '500,0,%,syncthing'

10
detection/c2/unexpected-talkers-macos.sql
View File

@ -227,15 +227,15 @@ WHERE
)
AND id_exception_key IN (
'Apple Mac OS Application Signing,com.microsoft.OneDrive-mac',
'Developer ID Application: Adobe Inc. (JQ525L2MZD),com.adobe.Reader',
'Apple Mac OS Application Signing,com.ookla.speedtest-macos',
'Developer ID Application: Mozilla Corporation (43AQ936H96),org.mozilla.thunderbird',
'Developer ID Application: Adobe Inc. (JQ525L2MZD),com.adobe.AdobeResourceSynchronizer',
'Developer ID Application: Adobe Inc. (JQ525L2MZD),com.adobe.Reader',
'Developer ID Application: Bookry Ltd (4259LE8SU5),com.bookry.wavebox.helper',
'Developer ID Application: Brave Software, Inc. (KL8N8XSYF4),com.brave.Browser.helper',
'Developer ID Application: Adobe Inc. (JQ525L2MZD),com.adobe.AdobeResourceSynchronizer',
'Developer ID Application: Cloudflare Inc. (68WVV388M8),CloudflareWARP',
'Developer ID Application: Docker Inc (9BNSXJN65R),com.docker',
'Developer ID Application: Epic Games International, S.a.r.l. (96DBZ92D3Y),com.epicgames.EpicGamesLauncher',
'Developer ID Application: Epic Games International, S.a.r.l. (96DBZ92D3Y),com.epicgames.UE4EditorServices',
'Developer ID Application: Fortinet, Inc (AH4XFXJ7DK),fctupdate',
'Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D),com.googlecode.iterm2',
'Developer ID Application: Google LLC (EQHXZ8M8AV),com.google.Chrome.helper',
@ -245,6 +245,7 @@ WHERE
'Developer ID Application: Microsoft Corporation (UBF8T346G9),net.java.openjdk.java',
'Developer ID Application: Mozilla Corporation (43AQ936H96),org.mozilla.firefox',
'Developer ID Application: Mozilla Corporation (43AQ936H96),org.mozilla.firefoxdeveloperedition',
'Developer ID Application: Mozilla Corporation (43AQ936H96),org.mozilla.thunderbird',
'Developer ID Application: Opera Software AS (A2P9LX4JPN),com.operasoftware.Opera.helper',
'Developer ID Application: Parallels International GmbH (4C6364ACXT),com.parallels.naptd',
'Developer ID Application: Skype Communications S.a.r.l (AL798K98FX),com.skype.skype.Helper',
@ -255,7 +256,8 @@ WHERE
'Developer ID Application: TechSmith Corporation (7TQL462TU8),com.techsmith.snagit.capturehelper2020',
'Developer ID Application: The Browser Company of New York Inc. (S6N382Y83G),company.thebrowser.browser.helper',
'Developer ID Application: Valve Corporation (MXGJJ98X76),com.valvesoftware.steam',
'Developer ID Application: Vladimir Prelovac (TFVG979488),com.apple.WebKit.Networking'
'Developer ID Application: Vladimir Prelovac (TFVG979488),com.apple.WebKit.Networking',
'Developer ID Application: Zwift, Inc (C2GM8Y9VFM),ZwiftAppSilicon'
)
)
GROUP BY

3
detection/evasion/missing-from-disk-macos.sql
View File

@ -22,6 +22,7 @@ SELECT
p.cwd,
p.on_disk,
p.state,
strftime('%s', 'now') - p.start_time AS age,
pp.on_disk AS parent_on_disk,
pp.path AS parent_path,
pp.cmdline AS parent_cmd,
@ -33,7 +34,7 @@ FROM
LEFT JOIN hash ON pp.path = hash.path
WHERE
p.on_disk != 1 -- false positives from recently spawned processes
AND (strftime('%s', 'now') - p.start_time) > 15
AND (strftime('%s', 'now') - p.start_time) > 900
AND p.pid > 0
AND p.parent != 2 -- kthreadd
AND p.state != 'Z' -- The kernel no longer has enough tracking information for this alert to be useful

1
detection/evasion/unexpected-hidden-system-paths.sql
View File

@ -67,6 +67,7 @@ WHERE
'/.lesshst',
'/.mozilla/',
'/.vol/',
'/var/root/.zsh_history',
'/dev/.mdadm/',
'/etc/.#sudoers',
'/etc/.clean',

22
detection/execution/recently-created-executables-long-lived-macos.sql
View File

@ -86,28 +86,29 @@ WHERE
'~/Library/Application Support/BraveSoftware/',
'~/Library/Application Support/com.elgato.StreamDeck/',
'~/Library/Application Support/duckly/',
'~/Library/Application Support/com.elgato.StreamDeck/',
'~/Library/Application Support/Figma/',
'~/.vscode/extensions/ms-vscode.cpptools-1.15.4-darwin-arm64/',
'~/Library/Application Support/Steam/',
'~/Library/Application Support/Zed/',
'~/Library/Application Support/WebEx Folder/',
'/Library/Application Support/EcammLive',
'/usr/local/kolide-k2/Kolide.app/Contents/MacOS',
'~/Library/Application Support/Figma/',
'~/Library/Application Support/Foxit Software/',
'~/Library/Application Support/JetBrains/',
'~/Library/Application Support/OpenLens',
'~/Library/Application Support/sourcegraph-sp/',
'~/Library/Application Support/Steam/',
'~/Library/Application Support/WebEx Folder/',
'~/Library/Application Support/Zed/',
'~/Library/Application Support/Zwift/',
'~/Library/Application Support/Zwift',
'~/Library/Caches/com.mimestream.Mimestream/',
'~/Library/Caches/company.thebrowser.Browser/',
'~/Library/Caches/com.sempliva.Tiles/',
'~/Library/Caches/JetBrains/',
'~/Library/Caches/org.gpgtools.updater/',
'~/Library/Caches/snyk/',
'~/projects/go/src/',
'~/Library/Caches/company.thebrowser.Browser/',
'/Library/Developer/Xcode/',
'~/.terraform.d/plugin-cache/registry.terraform.io/'
'~/.local/share/bob/',
'~/projects/go/src/',
'~/.terraform.d/plugin-cache/registry.terraform.io/',
'/usr/local/kolide-k2/Kolide.app/Contents/MacOS',
'~/.vscode/extensions/ms-vscode.cpptools-1.15.4-darwin-arm64/'
)
OR dir IN (
'~/bin',
@ -152,6 +153,7 @@ WHERE
'Developer ID Application: Brave Software, Inc. (KL8N8XSYF4)',
'Developer ID Application: Brother Industries, LTD. (5HCL85FLGW)',
'Developer ID Application: Bryan Jones (49EYHPJ4Q3)',
'Developer ID Application: Zwift, Inc (C2GM8Y9VFM)',
'Developer ID Application: Canon Inc. (XE2XNRRXZ5)',
'Developer ID Application: Cisco (DE8Y96K9QP)',
'Developer ID Application: CodeWeavers Inc. (9C6B7X7Z8E)',

3
detection/execution/unexpected-execdir-events-macos.sql
View File

@ -155,6 +155,8 @@ WHERE
'/Volumes/Slack/Slack.app',
'/opt/homebrew/Caskroom',
'/opt/homebrew/Cellar',
'/opt/rapid7/ir_agent',
'/opt/Elastic/Endpoint',
'/Library/Elastic/Agent',
'/opt/homebrew/Library',
'/private/var/kolide-k2',
@ -317,6 +319,7 @@ WHERE
'Developer ID Application: Brother Industries, LTD. (5HCL85FLGW)',
'Developer ID Application: Canonical Group Limited (X4QN7LTP59)',
'Developer ID Application: Cisco (DE8Y96K9QP)',
'Developer ID Application: Rapid7 LLC (UL6CGN7MAL)',
'Developer ID Application: CodeWeavers Inc. (9C6B7X7Z8E)',
'Developer ID Application: Canon Inc. (XE2XNRRXZ5)',
'Developer ID Application: Corsair Memory, Inc. (Y93VXCB8Q5)',

3
detection/execution/unexpected-execdir-macos.sql
View File

@ -141,6 +141,7 @@ WHERE
'~/Library/Caches/com.mimestream.Mimestream/',
'~/Library/Caches/com.sempliva.Tiles/',
'~/.local/share/bob/',
'/opt/rapid7/ir_agent',
'~/anaconda3/Anaconda-Navigator.app/Contents/',
'~/Library/Services/UE4EditorServices.app/',
'~/Library/Caches/com.grammarly.ProjectLlama/',
@ -181,6 +182,7 @@ WHERE
'Developer ID Application: Corsair Memory, Inc. (Y93VXCB8Q5)',
'Developer ID Application: Docker Inc (9BNSXJN65R)',
'Developer ID Application: Dropbox, Inc. (G7HH3F8CAK)',
'Developer ID Application: Elasticsearch, Inc (2BT3HPN62Z)',
'Developer ID Application: EnterpriseDB Corporation (26QKX55P9K)',
'Developer ID Application: Epic Games International, S.a.r.l. (96DBZ92D3Y)',
'Developer ID Application: Figma, Inc. (T8RA8NE3B7)',
@ -196,6 +198,7 @@ WHERE
'Developer ID Application: Objective-See, LLC (VBG97UB4TA)',
'Developer ID Application: Opal Camera Inc (97Z3HJWCRT)',
'Developer ID Application: Oracle America, Inc. (VB5E2TV963)',
'Developer ID Application: Rapid7 LLC (UL6CGN7MAL)',
'Developer ID Application: Sublime HQ Pty Ltd (Z6D26JE4Y4)',
'Developer ID Application: TablePlus Inc (3X57WP8E8V)',
'Developer ID Application: Tenable, Inc. (4B8J598M7U)',