Thomas Stromberg
|
280b187b20
|
fpr: systemctl calls, go tests, WebEx, MariaDB, Brave
|
2023-01-20 17:55:48 -05:00 |
|
Thomas Stromberg
|
6858bb29eb
|
framework: Add exception for github runner
|
2023-01-20 09:59:43 -05:00 |
|
Thomas Stromberg
|
045b8ea524
|
execdir: exception for JetBrains
|
2023-01-20 09:57:12 -05:00 |
|
Thomas Stromberg
|
29d563f2df
|
Add more examples of legit executables, namely ibus-* and *Manager
|
2023-01-20 09:29:10 -05:00 |
|
Thomas Stromberg
|
e6824d87e9
|
Run 'make reformat'
|
2023-01-20 09:24:24 -05:00 |
|
Thomas Stromberg
|
dc154a6199
|
FPR: Meta Pixel Helper, systemctl, pia-daemon, 1Passwd, iTerm, Brave
|
2023-01-20 09:04:00 -05:00 |
|
Thomas Stromberg
|
8e9ae0fda3
|
Less false positives: particularly among systemctl calls
|
2023-01-20 08:40:08 -05:00 |
|
Thomas Stromberg
|
710ca28ed9
|
False positives: apt-daily, github runner, Slack helper, Foxit, syncthing
|
2023-01-19 11:52:31 -05:00 |
|
Thomas Stromberg
|
f5e08ceec2
|
False positives: Chrome extensions, Steam games, tmp files, Photoshop
|
2023-01-18 14:10:33 -05:00 |
|
Thomas Stromberg
|
ef5d8afdd0
|
False positives: homekit, setxid overflows, buildx, tmp files
|
2023-01-18 10:57:43 -05:00 |
|
Thomas Stromberg
|
7b79b19090
|
False positive reduction: Messenger, Chrome, Final Cut Pro, etc
|
2023-01-18 09:49:56 -05:00 |
|
Thomas Stromberg
|
09601ed3f0
|
Switch interval back to 300
|
2023-01-16 13:58:24 -05:00 |
|
Thomas Stromberg
|
5db432b2c6
|
Add compile (Go Lang) to exceptions list
|
2023-01-16 13:57:14 -05:00 |
|
Thomas Stromberg
|
42e9f2721b
|
FP removal: plymouth, 1Password, firejail, systemd
|
2023-01-16 13:55:53 -05:00 |
|
Thomas Stromberg
|
d415b36b57
|
FP removal: Selenium, PolKit helper, gephi, docker-credential-gcloud, firejail, etc
|
2023-01-16 12:56:39 -05:00 |
|
Thomas Stromberg
|
e3401a07c6
|
Weekend false-positive flush
|
2023-01-14 08:19:26 -05:00 |
|
Thomas Stromberg
|
cb896b9e10
|
Filter out new false positives
|
2023-01-13 15:24:18 -05:00 |
|
Thomas Stromberg
|
1b79359b68
|
Friday False Positive Flush
|
2023-01-13 14:10:43 -05:00 |
|
Thomas Strömberg
|
cb0ed647d8
|
Merge branch 'main' into bugfixesJan13
|
2023-01-13 13:56:19 -05:00 |
|
Thomas Stromberg
|
9d7bd98875
|
Compare euid against process_events as processes may not join
|
2023-01-13 13:55:03 -05:00 |
|
Thomas Stromberg
|
edc9e4b527
|
Exclude _darwin_x paths in home
|
2023-01-13 13:54:28 -05:00 |
|
Thomas Stromberg
|
27dfda38ed
|
Remove whitelist for ~/Library and ~/.local
|
2023-01-13 13:54:04 -05:00 |
|
Thomas Stromberg
|
46024618f5
|
Fix regular expressions, include more commands
|
2023-01-13 13:50:37 -05:00 |
|
Thomas Stromberg
|
41e68657e9
|
Include more commands
|
2023-01-13 13:49:41 -05:00 |
|
Thomas Stromberg
|
7073cde5f0
|
Allow chmod 0777 to match
|
2023-01-13 13:48:02 -05:00 |
|
Thomas Strömberg
|
6df2d80a75
|
Merge pull request #121 from tstromberg/security-framework
new detector: unexpected security framework program
|
2023-01-13 12:33:39 -05:00 |
|
Thomas Stromberg
|
92f2ce8f95
|
new detector: unexpected security framework program
|
2023-01-13 12:33:19 -05:00 |
|
Thomas Strömberg
|
f75d57d0f8
|
Merge pull request #120 from tstromberg/chmod
new detector: unexpected file made executable
|
2023-01-13 12:11:09 -05:00 |
|
Thomas Stromberg
|
36cac9722b
|
new detector: unexpected file made executable
|
2023-01-13 12:10:43 -05:00 |
|
Thomas Strömberg
|
e905881e58
|
Merge pull request #119 from tstromberg/xattr
new detector: unexpected xattr calls
|
2023-01-13 11:38:47 -05:00 |
|
Thomas Stromberg
|
53bc99da88
|
new detector: unexpected xattr calls
|
2023-01-13 11:38:19 -05:00 |
|
Thomas Stromberg
|
420d269025
|
Reformat and reduce false positives
|
2023-01-09 15:10:48 -05:00 |
|
Thomas Stromberg
|
b6a34d4084
|
Add unpathed exception to sysctl.proc_translated, remove exception_key
|
2023-01-09 10:54:44 -05:00 |
|
Thomas Stromberg
|
c7e4252af1
|
Remove false positives, fix some queries that failed to show a parent pid
|
2023-01-09 10:46:30 -05:00 |
|
Thomas Strömberg
|
1bd030a2f2
|
Merge pull request #114 from tstromberg/sysctl
new detector: unexpected sysctl calls
|
2023-01-09 09:36:01 -05:00 |
|
Thomas Stromberg
|
c495bfccac
|
new detector: unexpected sysctl calls
|
2023-01-09 09:35:17 -05:00 |
|
Thomas Stromberg
|
e8af31a348
|
false positives: dots, ipn, apport-gtk, homebrew, hyperkey, contexts
|
2023-01-09 09:34:20 -05:00 |
|
Thomas Stromberg
|
2bcf9316cf
|
Add some hash fields, fix some false positives
|
2023-01-09 09:04:38 -05:00 |
|
Thomas Stromberg
|
4eb6993272
|
Catch up to some older false positives we ran into
|
2023-01-06 17:11:24 -05:00 |
|
Thomas Stromberg
|
1aefbe5e91
|
More false positive removal
|
2023-01-06 16:01:35 -05:00 |
|
Thomas Stromberg
|
cd0b7872c1
|
Rewrite unexpected-osascript-calls for simplicity
|
2023-01-06 15:31:08 -05:00 |
|
Thomas Stromberg
|
05a39a78d3
|
Flush out more false positives across the stack
|
2023-01-06 10:36:48 -05:00 |
|
Thomas Stromberg
|
7455c22e3c
|
Fix missing /
|
2023-01-06 10:19:33 -05:00 |
|
Thomas Stromberg
|
9843def319
|
Fix more false positives, particularly in shell/fetcher parents
|
2023-01-06 10:18:19 -05:00 |
|
Thomas Strömberg
|
3db3559a7f
|
Merge pull request #108 from tstromberg/shell-parent-events
new detectors: unexpected shell & fetcher events
|
2023-01-04 15:49:36 -05:00 |
|
Thomas Stromberg
|
9c512c5fd7
|
new detector: unexpected fetcher parents
|
2023-01-04 15:48:13 -05:00 |
|
Thomas Strömberg
|
88e0e5fb57
|
Merge pull request #107 from tstromberg/root-signers
new detector: unexpected root process signer on macOS
|
2023-01-04 11:20:27 -05:00 |
|
Thomas Stromberg
|
64ed2bba02
|
new detector: software running as root on macOS with an unexpected authority
|
2023-01-04 11:19:44 -05:00 |
|
Thomas Strömberg
|
6f160c686d
|
Merge pull request #106 from tstromberg/relative-exec
New detector: relative exec low uid
|
2023-01-04 11:15:09 -05:00 |
|
Thomas Stromberg
|
ef3653216e
|
New detector: relative exec low uid
|
2023-01-04 11:14:04 -05:00 |
|