547 Commits

Author	SHA1	Message	Date
Thomas Stromberg	430f397f1e	fpr: Velociraptor, Hyprland, iio	2023-07-12 15:00:36 -04:00
Thomas Stromberg	9d93799cb5	Add 'management' to the list of permissions to check for	2023-07-05 12:47:00 -04:00
Thomas Stromberg	97bfc30b92	Update false positive list, add mtime/btime	2023-07-05 12:26:14 -04:00
Thomas Stromberg	c9f0b2bee5	fpr: Steam, Presenting, Wavebox, multipass, parallels, cargo, dnf, Kindle, DaveTheDiver	2023-07-03 07:16:14 -04:00
Thomas Stromberg	d74405c817	fpr: Brave, Adobe, Signal, Kandji, SteelSeries, etc	2023-06-30 16:38:31 -04:00
Thomas Strömberg	c71952d3a8	Merge pull request #286 from tstromberg/jokerspy ... New detectors based on JokerSpy research	2023-06-30 15:40:00 -04:00
Thomas Stromberg	ce03badae4	Reformat	2023-06-30 15:38:56 -04:00
Thomas Stromberg	cebf617c82	fpr: terragrunt, mdnsResponder, Spotify, Zoom, etc	2023-06-14 10:58:41 -04:00
Thomas Stromberg	2d8abbaed9	Improve targeting of Unexpected Chrome Extensions	2023-06-14 10:32:11 -04:00
Thomas Stromberg	32328c91f1	fpr: Slack, Gnome, Sigstore, Logitune, etc	2023-06-12 10:10:57 -04:00
Thomas Strömberg	c096acee92	Merge pull request #282 from tstromberg/dns ... Cleanup unexpected-dns-traffic-events	2023-06-09 09:46:20 -04:00
Thomas Stromberg	b5e765efed	Cleanup unexpected-dns-traffic-events	2023-06-09 08:56:17 -04:00
Thomas Strömberg	1654c03677	Merge pull request #281 from tstromberg/less-persist ... recently created: set cutoff to 12h, exclude SteelSeries	2023-06-09 07:55:46 -04:00
Thomas Stromberg	ccdd5e2d4f	set cutoff to 12h, exclude SteelSeries	2023-06-09 07:42:30 -04:00
Thomas Strömberg	57cc0ec64d	Merge pull request #279 from tstromberg/minecraft ... false positive: Minecraft	2023-06-09 07:35:05 -04:00
Thomas Stromberg	838e0f6a4d	recently created: set cut-off to 30 minutes	2023-06-09 07:29:00 -04:00
Thomas Stromberg	35433beb05	false positive: Minecraft	2023-06-09 07:28:05 -04:00
Thomas Strömberg	bdecfa4996	Merge pull request #278 from tstromberg/multipass ... launchd: Add Canonical exception	2023-06-09 07:17:22 -04:00
Thomas Stromberg	6adc121c4d	launchd: Add Canonical exception	2023-06-09 07:15:24 -04:00
Thomas Stromberg	d5c6233716	hidden executable: Add provisio exception	2023-06-09 07:12:16 -04:00
Thomas Strömberg	d08fdd38b2	Merge pull request #276 from tstromberg/faster-sockets ... minimal socket client: speed query up	2023-06-08 20:46:49 -04:00
Thomas Stromberg	cae042cbe5	minimal socket client: speed query up	2023-06-08 20:44:08 -04:00
Thomas Stromberg	9851aaa192	Add exceptions for common hidden directories	2023-06-08 20:27:01 -04:00
Thomas Stromberg	937bcabfec	Remove extra file	2023-06-08 18:27:46 -04:00
Thomas Stromberg	ff2ab95431	Remove file sizes from systemd exception key	2023-06-08 18:26:57 -04:00
Thomas Strömberg	06b95a57b3	Merge pull request #272 from tstromberg/unattended ... Add unattended-upgrades.pid (Ubuntu)	2023-06-07 15:19:58 -04:00
Thomas Stromberg	7a61b5eced	Add ~/.config/.* to search criteria	2023-06-07 15:15:02 -04:00
Thomas Stromberg	404b7125f7	Add unattended-upgrades.pid (Ubuntu	2023-06-07 15:14:09 -04:00
Thomas Stromberg	c8760e0ae1	fpr: macOS, Signal, Creative Labs, node, etc	2023-06-07 09:55:17 -04:00
Thomas Stromberg	349ff58fb2	fpr: xfce4, Google Earth, Ubuntu	2023-06-07 08:58:02 -04:00
Thomas Stromberg	1c3d461392	Add lock exception for pipewire	2023-06-02 19:22:26 -04:00
Thomas Stromberg	066c88dc18	fpr: multipass, go, macOS, Ubuntu, Opera, git, ko	2023-06-02 19:08:08 -04:00
Thomas Stromberg	37ce71b94f	Decrease download limits to begin with	2023-06-02 18:03:44 -04:00
Thomas Stromberg	c2ce0ce7d7	New queries: excessive Google Drive exports	2023-06-02 18:01:10 -04:00
Thomas Stromberg	9575d18bc2	fpr: FleetDM, Edge, VSCode, dnf, Steam, etc	2023-06-01 11:52:20 -04:00
Thomas Stromberg	7446b55120	Fix missing apostrophe	2023-05-23 11:55:11 -04:00
Thomas Stromberg	4831794034	Rename from missing-parent	2023-05-23 11:31:58 -04:00
Thomas Stromberg	111c15e20b	fpr: macOS, yubikey, Premiere, dnf, vagrant, etc	2023-05-23 11:31:37 -04:00
Thomas Stromberg	56ede74c54	fpr: Parallels, Stream Deck, tflint, gitstatus, snyk	2023-05-17 17:52:55 -04:00
Thomas Stromberg	d9d6a836a7	Update minimal socket exceptions to not rely signatures	2023-05-17 13:21:29 -04:00
Thomas Stromberg	c6eec0ee17	Query tuning after Geacon testing	2023-05-17 10:54:16 -04:00
Thomas Stromberg	24c2baef28	Make process times broadly available, minor opts	2023-05-16 17:18:39 -04:00
Thomas Stromberg	7f86db5521	Improve detection for bpfdoor and similar backdoors.	2023-05-16 16:31:31 -04:00
Thomas Stromberg	93f2f2baf4	Fix comma placement	2023-05-16 10:31:46 -04:00
Thomas Stromberg	d5a94b21d1	fpr: Kolide, macOS, nvidia, neko	2023-05-16 10:28:19 -04:00
Thomas Stromberg	9c87838b9f	fpr: Chrome, Kolide	2023-05-12 16:41:17 -04:00
Thomas Stromberg	26b2b9a4c7	fpr: LGHUB, aomshm, Wisdolia, uubyte, eclipse, etc	2023-05-11 11:29:55 -04:00
Thomas Stromberg	099d6664fe	Remove seldom modifier, reformat	2023-05-11 10:33:51 -04:00
Thomas Stromberg	c58cac1a1f	New detector: unexpected /var/run files	2023-05-11 10:32:17 -04:00
Thomas Stromberg	49debb32c6	fix duplicate cloud-sql-proxy exception	2023-05-08 13:23:20 -04:00