272 Commits

Author	SHA1	Message	Date
Thomas Stromberg	3cc2af51c1	fpr: elastic, rapid7, zwift	2024-01-10 11:20:04 -05:00
Thomas Stromberg	229a32a61e	fpr: sourcegraph,phantombuster,iterm,cody,stickers	2024-01-09 16:14:00 -05:00
Thomas Stromberg	875125fc94	Add exceptions for Elastic Defend & Rapid7 InsightIDR	2024-01-08 19:07:57 -05:00
Thomas Stromberg	1304d66783	Add more Elastic exceptions	2024-01-08 17:55:30 -05:00
Thomas Stromberg	336a1fca4a	Add exceptions for Elastic Defend	2024-01-08 17:18:25 -05:00
Thomas Stromberg	202ce6be45	Ignore syncthing, nuclei, fix typos	2023-12-15 17:19:38 -05:00
Thomas Stromberg	800e4aa2cc	fpr: kind of everything	2023-12-15 17:10:06 -05:00
Thomas Stromberg	310e51d2a2	fpr: Capture One, Grammarly, Mullvad, etc	2023-12-08 17:12:27 -05:00
Thomas Stromberg	40078d357a	fpr: ThingsWidgetExtension	2023-11-02 11:17:58 -04:00
Thomas Stromberg	6e1e7f29c2	fpr: dbeaver, AwesomeScreenshot, Hyper, etc	2023-11-02 09:39:41 -04:00
Thomas Stromberg	0060bb087e	fpr: aws, java, arch, cody, google, wireshark, etc	2023-10-31 11:40:10 -04:00
Thomas Strömberg	51baf32292	Merge pull request #331 from tstromberg/fpr-oct25 ... fpr: rootlesskit, sshd, Fedora, Oracle Linux	2023-10-25 13:42:56 -04:00
Thomas Stromberg	23fadda33b	fpr: rootlesskit, sshd, Fedora, Oracle Linux	2023-10-25 13:42:22 -04:00
Thomas Stromberg	d7990dd063	fpr: Electron, Github	2023-10-25 09:49:07 -04:00
Thomas Stromberg	7d9aced380	fpr: mtr, vscode, cpptools, cron, firefox	2023-10-25 09:18:04 -04:00
Thomas Stromberg	9e6df92e3f	fpr: osquery release spam	2023-10-24 18:32:03 -04:00
Thomas Stromberg	3c2be1c16e	fpr: Kolide, qemu, bash, monday, macOS	2023-10-24 18:01:36 -04:00
Thomas Stromberg	bf66053d5c	fpr: containerd, hyper, Docker, Chromium, spotify, busycal	2023-10-02 16:11:44 -04:00
Thomas Stromberg	42c0a15e2a	Fix vpl, kolide exceptions, increase timeouts for yara	2023-10-02 11:45:27 -04:00
Thomas Stromberg	5f2680ca8b	fpr: Monday, Splunk, Gnome, Git, Grammarly, etc	2023-10-02 11:35:11 -04:00
Thomas Stromberg	f73263bece	fpr: docker, fish, Stream Deck, rsync, lima, macOS	2023-09-26 15:14:38 -04:00
Thomas Strömberg	c3df9bdea5	Merge pull request #320 from tstromberg/lima-ubuntu-fpr ... Reduce false positives on Ubuntu + Lima	2023-09-26 13:13:13 -04:00
Thomas Stromberg	a7f0b3001d	Reduce false positives on Ubuntu + Lima	2023-09-26 13:09:22 -04:00
Thomas Stromberg	6b4700c3dd	Address issues which kept these alerts from firing	2023-09-24 22:02:34 -04:00
Thomas Stromberg	b39fca4e9f	fpr: RSA keys, tcpdump, login, crane, souregraph, etc	2023-09-20 09:30:46 -04:00
Thomas Stromberg	bfdc509243	new check: hidden cwd events	2023-09-19 17:18:35 -04:00
Thomas Stromberg	cf175ec48d	More checks for unusual process names inspired by Earth Lusca	2023-09-18 14:14:40 -04:00
Thomas Stromberg	f16c3cdf53	fpr: sourcegraph, nginx, factorio, fan control, emacs, nushell	2023-09-14 17:13:12 -04:00
Thomas Stromberg	190e8adcfd	Merge to master	2023-09-01 17:34:36 -04:00
Thomas Stromberg	b889cde6d5	Additional fixes for Ventura & Capture One	2023-09-01 17:27:27 -04:00
Thomas Stromberg	84125c4bb1	Remove recently common false positives	2023-09-01 17:09:47 -04:00
Thomas Stromberg	188bc78f4c	Fix errors	2023-08-15 18:29:27 -04:00
Thomas Stromberg	dce2eb2af5	Add many exceptions	2023-08-15 18:13:06 -04:00
Thomas Stromberg	ce2f0f06cb	fpr; Keybase, grype, UpdateBrainService, OpenOffice, sqlproxy	2023-07-20 10:56:49 -04:00
Thomas Stromberg	921cdc521e	fpr: nvidia drivers, su, agetty, crystalhd, hercules, etc	2023-07-19 15:22:43 -04:00
Thomas Stromberg	485f69a61c	fpr: Revolt, Bearly, user executables, melange	2023-07-13 19:43:35 -04:00
Thomas Stromberg	870ea132ee	Decrease search depth for performance	2023-07-12 19:29:48 -04:00
Thomas Stromberg	a0e4183bf4	fpr: Velociraptor, nessus, kandji, java, SteelSeries, etc	2023-07-12 17:38:26 -04:00
Thomas Stromberg	6acc441dcf	Add rustbucket comment	2023-07-12 16:46:00 -04:00
Thomas Stromberg	a7cd9abaf3	new detector: unexpected process extension linux	2023-07-12 16:06:05 -04:00
Thomas Stromberg	c9f0b2bee5	fpr: Steam, Presenting, Wavebox, multipass, parallels, cargo, dnf, Kindle, DaveTheDiver	2023-07-03 07:16:14 -04:00
Thomas Stromberg	d74405c817	fpr: Brave, Adobe, Signal, Kandji, SteelSeries, etc	2023-06-30 16:38:31 -04:00
Thomas Strömberg	c71952d3a8	Merge pull request #286 from tstromberg/jokerspy ... New detectors based on JokerSpy research	2023-06-30 15:40:00 -04:00
Thomas Stromberg	ce03badae4	Reformat	2023-06-30 15:38:56 -04:00
Thomas Stromberg	cebf617c82	fpr: terragrunt, mdnsResponder, Spotify, Zoom, etc	2023-06-14 10:58:41 -04:00
Thomas Stromberg	32328c91f1	fpr: Slack, Gnome, Sigstore, Logitune, etc	2023-06-12 10:10:57 -04:00
Thomas Stromberg	d5c6233716	hidden executable: Add provisio exception	2023-06-09 07:12:16 -04:00
Thomas Stromberg	9851aaa192	Add exceptions for common hidden directories	2023-06-08 20:27:01 -04:00
Thomas Stromberg	ff2ab95431	Remove file sizes from systemd exception key	2023-06-08 18:26:57 -04:00
Thomas Strömberg	06b95a57b3	Merge pull request #272 from tstromberg/unattended ... Add unattended-upgrades.pid (Ubuntu)	2023-06-07 15:19:58 -04:00