RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

unexpected talker events: address easy false positives

This commit is contained in:
Thomas Stromberg 2023-09-19 17:17:58 -04:00
parent 9722d9f156
commit f656aef8be
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
detection/c2/unexpected-talker-events.sql
View File

@ -82,8 +82,11 @@ WHERE
'/Library/Application Support',
'/Library/Kandji',
'/System/Volumes',
'~/bin',
'/usr/local',
'/opt/homebrew',
'~/Apps',
'~/code',
'~/work',
'~/github',
'~/src',
@ -97,8 +100,10 @@ WHERE
AND NOT exception_key IN (
'500,0,123,sntp',
'500,0,22,ssh',
'500,0,443,velociraptor',
'500,0,32768,ksfetch',
'500,500,32768,ksfetch',
'500,500,443,old',
'500,0,32768,syncthing',
'500,0,443,chrome',
'500,0,443,curl',
@ -107,11 +112,18 @@ WHERE
'500,0,443,launcher',
'500,0,443,slack',
'500,0,31488,sntp',
'500,500,443,go',
'500,0,443,syncthing',
'500,0,443,wget',
'500,0,5228,chrome',
'500,0,53,chrome',
'500,0,53,git',
'500,0,443,firefox',
'500,0,80,firefox',
'500,0,443,node',
'500,500,2304,cloud_sql_proxy',
'500,500,443,cloud_sql_proxy',
'500,500,80,cloud_sql_proxy',
'500,0,53,launcher',
'500,0,53,NetworkManager',
'500,0,53,slack',