Commit Graph

553 Commits

Author SHA1 Message Date
Thomas Strömberg
8325325996
Merge pull request #129 from tstromberg/fp3
False positives: Chrome extensions, Steam games, tmp files, Photoshop
2023-01-18 14:42:10 -05:00
Thomas Stromberg
5c421f7c96
Refactor unexpected-tmp-executables for magic awareness 2023-01-18 14:41:36 -05:00
Thomas Stromberg
f5e08ceec2
False positives: Chrome extensions, Steam games, tmp files, Photoshop 2023-01-18 14:10:33 -05:00
Thomas Strömberg
0ea1146cd5
Merge pull request #128 from tstromberg/fp3
False positives: homekit, setxid overflows, buildx, tmp, Messenger, etc
2023-01-18 10:58:46 -05:00
Thomas Stromberg
ef5d8afdd0
False positives: homekit, setxid overflows, buildx, tmp files 2023-01-18 10:57:43 -05:00
Thomas Stromberg
7b79b19090
False positive reduction: Messenger, Chrome, Final Cut Pro, etc 2023-01-18 09:49:56 -05:00
Thomas Strömberg
c6221f9d7b
Merge pull request #127 from tstromberg/fp3
FP removal: plymouth, 1Password, firejail, systemd, compile
2023-01-16 13:58:43 -05:00
Thomas Stromberg
09601ed3f0
Switch interval back to 300 2023-01-16 13:58:24 -05:00
Thomas Stromberg
5db432b2c6
Add compile (Go Lang) to exceptions list 2023-01-16 13:57:14 -05:00
Thomas Stromberg
42e9f2721b
FP removal: plymouth, 1Password, firejail, systemd 2023-01-16 13:55:53 -05:00
Thomas Strömberg
45e11c16ec
Merge pull request #126 from tstromberg/fp3
FP's: Selenium, polkit, gephi, docker-credential-gcloud, firejail, etc
2023-01-16 12:57:54 -05:00
Thomas Stromberg
d415b36b57
FP removal: Selenium, PolKit helper, gephi, docker-credential-gcloud, firejail, etc 2023-01-16 12:56:39 -05:00
Thomas Strömberg
9553b75f54
Merge pull request #125 from tstromberg/fp2
False positives: terraform, docker, qemu, aws, lima, etc.
2023-01-14 08:21:14 -05:00
Thomas Stromberg
431720103e
Remove dupe entry 2023-01-14 08:20:11 -05:00
Thomas Stromberg
e3401a07c6
Weekend false-positive flush 2023-01-14 08:19:26 -05:00
Thomas Strömberg
f3c1ce8533
Merge pull request #124 from tstromberg/fp2
Filter out new false positives
2023-01-13 15:24:57 -05:00
Thomas Stromberg
cb896b9e10
Filter out new false positives 2023-01-13 15:24:18 -05:00
Thomas Strömberg
68555e1b85
Merge pull request #123 from tstromberg/fp1
Friday False Positive Flush
2023-01-13 14:11:17 -05:00
Thomas Stromberg
1b79359b68
Friday False Positive Flush 2023-01-13 14:10:43 -05:00
Thomas Strömberg
0054ce7c3a
Merge pull request #122 from tstromberg/bugfixesJan13
Various query bugfixes from the 2022 macOS malware audit
2023-01-13 13:56:25 -05:00
Thomas Strömberg
cb0ed647d8
Merge branch 'main' into bugfixesJan13 2023-01-13 13:56:19 -05:00
Thomas Stromberg
9d7bd98875
Compare euid against process_events as processes may not join 2023-01-13 13:55:03 -05:00
Thomas Stromberg
edc9e4b527
Exclude _darwin_x paths in home 2023-01-13 13:54:28 -05:00
Thomas Stromberg
27dfda38ed
Remove whitelist for ~/Library and ~/.local 2023-01-13 13:54:04 -05:00
Thomas Stromberg
46024618f5
Fix regular expressions, include more commands 2023-01-13 13:50:37 -05:00
Thomas Stromberg
41e68657e9
Include more commands 2023-01-13 13:49:41 -05:00
Thomas Stromberg
4ec1581cc3
Also include binaries running from a hidden directory (1 deep) 2023-01-13 13:48:47 -05:00
Thomas Stromberg
00872b28bb
Speed query up by first referencing processes table 2023-01-13 13:48:22 -05:00
Thomas Stromberg
7073cde5f0
Allow chmod 0777 to match 2023-01-13 13:48:02 -05:00
Thomas Stromberg
1084843ed4
Add header metadata 2023-01-13 13:47:33 -05:00
Thomas Stromberg
c045daa8f9
Remove Python whitelist, see pymafka 2023-01-13 13:47:19 -05:00
Thomas Stromberg
dd3149a34b
Add support for .pkg files 2023-01-13 13:47:02 -05:00
Thomas Strömberg
6df2d80a75
Merge pull request #121 from tstromberg/security-framework
new detector: unexpected security framework program
2023-01-13 12:33:39 -05:00
Thomas Stromberg
92f2ce8f95
new detector: unexpected security framework program 2023-01-13 12:33:19 -05:00
Thomas Strömberg
f75d57d0f8
Merge pull request #120 from tstromberg/chmod
new detector: unexpected file made executable
2023-01-13 12:11:09 -05:00
Thomas Stromberg
36cac9722b
new detector: unexpected file made executable 2023-01-13 12:10:43 -05:00
Thomas Strömberg
e905881e58
Merge pull request #119 from tstromberg/xattr
new detector: unexpected xattr calls
2023-01-13 11:38:47 -05:00
Thomas Stromberg
53bc99da88
new detector: unexpected xattr calls 2023-01-13 11:38:19 -05:00
Thomas Strömberg
ff899f0bcb
Merge pull request #118 from tstromberg/service-accounts
new detector: unencrypted GCP service account keys
2023-01-13 11:22:23 -05:00
Thomas Stromberg
7b83467305
new detector: unencrypted GCP service account keys 2023-01-13 11:21:48 -05:00
Thomas Strömberg
81a6e99436
Merge pull request #117 from tstromberg/less-false2
Speed up unexpected-bpf-users query by basing it on processes
2023-01-09 15:19:08 -05:00
Thomas Stromberg
4000bac9f9
Speed up unexpected-bpf-users query by basing it on processes 2023-01-09 15:18:00 -05:00
Thomas Strömberg
b9a79aedf1
Merge pull request #116 from tstromberg/less-false2
Reformat and reduce false positives
2023-01-09 15:11:53 -05:00
Thomas Stromberg
420d269025
Reformat and reduce false positives 2023-01-09 15:10:48 -05:00
Thomas Stromberg
b6a34d4084
Add unpathed exception to sysctl.proc_translated, remove exception_key 2023-01-09 10:54:44 -05:00
Thomas Strömberg
814e11bdfd
Merge pull request #115 from tstromberg/less-false2
Remove false positives, fix queries that failed to show a parent pid
2023-01-09 10:47:19 -05:00
Thomas Stromberg
c7e4252af1
Remove false positives, fix some queries that failed to show a parent pid 2023-01-09 10:46:30 -05:00
Thomas Strömberg
1bd030a2f2
Merge pull request #114 from tstromberg/sysctl
new detector: unexpected sysctl calls
2023-01-09 09:36:01 -05:00
Thomas Stromberg
c495bfccac
new detector: unexpected sysctl calls 2023-01-09 09:35:17 -05:00
Thomas Strömberg
05721ed5c5
Merge pull request #113 from tstromberg/less-false
false positives + hashes: dots, ipn, apport-gtk, homebrew, hyperkey, contexts
2023-01-09 09:35:02 -05:00