Commit Graph

152 Commits

Author SHA1 Message Date
Thomas Stromberg
280b187b20
fpr: systemctl calls, go tests, WebEx, MariaDB, Brave 2023-01-20 17:55:48 -05:00
Thomas Stromberg
6858bb29eb
framework: Add exception for github runner 2023-01-20 09:59:43 -05:00
Thomas Stromberg
045b8ea524
execdir: exception for JetBrains 2023-01-20 09:57:12 -05:00
Thomas Stromberg
29d563f2df
Add more examples of legit executables, namely ibus-* and *Manager 2023-01-20 09:29:10 -05:00
Thomas Stromberg
e6824d87e9
Run 'make reformat' 2023-01-20 09:24:24 -05:00
Thomas Stromberg
dc154a6199
FPR: Meta Pixel Helper, systemctl, pia-daemon, 1Passwd, iTerm, Brave 2023-01-20 09:04:00 -05:00
Thomas Stromberg
8e9ae0fda3
Less false positives: particularly among systemctl calls 2023-01-20 08:40:08 -05:00
Thomas Stromberg
710ca28ed9
False positives: apt-daily, github runner, Slack helper, Foxit, syncthing 2023-01-19 11:52:31 -05:00
Thomas Stromberg
f5e08ceec2
False positives: Chrome extensions, Steam games, tmp files, Photoshop 2023-01-18 14:10:33 -05:00
Thomas Stromberg
ef5d8afdd0
False positives: homekit, setxid overflows, buildx, tmp files 2023-01-18 10:57:43 -05:00
Thomas Stromberg
7b79b19090
False positive reduction: Messenger, Chrome, Final Cut Pro, etc 2023-01-18 09:49:56 -05:00
Thomas Stromberg
09601ed3f0
Switch interval back to 300 2023-01-16 13:58:24 -05:00
Thomas Stromberg
5db432b2c6
Add compile (Go Lang) to exceptions list 2023-01-16 13:57:14 -05:00
Thomas Stromberg
42e9f2721b
FP removal: plymouth, 1Password, firejail, systemd 2023-01-16 13:55:53 -05:00
Thomas Stromberg
d415b36b57
FP removal: Selenium, PolKit helper, gephi, docker-credential-gcloud, firejail, etc 2023-01-16 12:56:39 -05:00
Thomas Stromberg
e3401a07c6
Weekend false-positive flush 2023-01-14 08:19:26 -05:00
Thomas Stromberg
cb896b9e10
Filter out new false positives 2023-01-13 15:24:18 -05:00
Thomas Stromberg
1b79359b68
Friday False Positive Flush 2023-01-13 14:10:43 -05:00
Thomas Strömberg
cb0ed647d8
Merge branch 'main' into bugfixesJan13 2023-01-13 13:56:19 -05:00
Thomas Stromberg
9d7bd98875
Compare euid against process_events as processes may not join 2023-01-13 13:55:03 -05:00
Thomas Stromberg
edc9e4b527
Exclude _darwin_x paths in home 2023-01-13 13:54:28 -05:00
Thomas Stromberg
27dfda38ed
Remove whitelist for ~/Library and ~/.local 2023-01-13 13:54:04 -05:00
Thomas Stromberg
46024618f5
Fix regular expressions, include more commands 2023-01-13 13:50:37 -05:00
Thomas Stromberg
41e68657e9
Include more commands 2023-01-13 13:49:41 -05:00
Thomas Stromberg
7073cde5f0
Allow chmod 0777 to match 2023-01-13 13:48:02 -05:00
Thomas Strömberg
6df2d80a75
Merge pull request #121 from tstromberg/security-framework
new detector: unexpected security framework program
2023-01-13 12:33:39 -05:00
Thomas Stromberg
92f2ce8f95
new detector: unexpected security framework program 2023-01-13 12:33:19 -05:00
Thomas Strömberg
f75d57d0f8
Merge pull request #120 from tstromberg/chmod
new detector: unexpected file made executable
2023-01-13 12:11:09 -05:00
Thomas Stromberg
36cac9722b
new detector: unexpected file made executable 2023-01-13 12:10:43 -05:00
Thomas Strömberg
e905881e58
Merge pull request #119 from tstromberg/xattr
new detector: unexpected xattr calls
2023-01-13 11:38:47 -05:00
Thomas Stromberg
53bc99da88
new detector: unexpected xattr calls 2023-01-13 11:38:19 -05:00
Thomas Stromberg
420d269025
Reformat and reduce false positives 2023-01-09 15:10:48 -05:00
Thomas Stromberg
b6a34d4084
Add unpathed exception to sysctl.proc_translated, remove exception_key 2023-01-09 10:54:44 -05:00
Thomas Stromberg
c7e4252af1
Remove false positives, fix some queries that failed to show a parent pid 2023-01-09 10:46:30 -05:00
Thomas Strömberg
1bd030a2f2
Merge pull request #114 from tstromberg/sysctl
new detector: unexpected sysctl calls
2023-01-09 09:36:01 -05:00
Thomas Stromberg
c495bfccac
new detector: unexpected sysctl calls 2023-01-09 09:35:17 -05:00
Thomas Stromberg
e8af31a348
false positives: dots, ipn, apport-gtk, homebrew, hyperkey, contexts 2023-01-09 09:34:20 -05:00
Thomas Stromberg
2bcf9316cf
Add some hash fields, fix some false positives 2023-01-09 09:04:38 -05:00
Thomas Stromberg
4eb6993272
Catch up to some older false positives we ran into 2023-01-06 17:11:24 -05:00
Thomas Stromberg
1aefbe5e91
More false positive removal 2023-01-06 16:01:35 -05:00
Thomas Stromberg
cd0b7872c1
Rewrite unexpected-osascript-calls for simplicity 2023-01-06 15:31:08 -05:00
Thomas Stromberg
05a39a78d3
Flush out more false positives across the stack 2023-01-06 10:36:48 -05:00
Thomas Stromberg
7455c22e3c
Fix missing / 2023-01-06 10:19:33 -05:00
Thomas Stromberg
9843def319
Fix more false positives, particularly in shell/fetcher parents 2023-01-06 10:18:19 -05:00
Thomas Strömberg
3db3559a7f
Merge pull request #108 from tstromberg/shell-parent-events
new detectors: unexpected shell & fetcher events
2023-01-04 15:49:36 -05:00
Thomas Stromberg
9c512c5fd7
new detector: unexpected fetcher parents 2023-01-04 15:48:13 -05:00
Thomas Strömberg
88e0e5fb57
Merge pull request #107 from tstromberg/root-signers
new detector: unexpected root process signer on macOS
2023-01-04 11:20:27 -05:00
Thomas Stromberg
64ed2bba02
new detector: software running as root on macOS with an unexpected authority 2023-01-04 11:19:44 -05:00
Thomas Strömberg
6f160c686d
Merge pull request #106 from tstromberg/relative-exec
New detector: relative exec low uid
2023-01-04 11:15:09 -05:00
Thomas Stromberg
ef3653216e
New detector: relative exec low uid 2023-01-04 11:14:04 -05:00