Thomas Strömberg
|
8325325996
|
Merge pull request #129 from tstromberg/fp3
False positives: Chrome extensions, Steam games, tmp files, Photoshop
|
2023-01-18 14:42:10 -05:00 |
|
Thomas Stromberg
|
5c421f7c96
|
Refactor unexpected-tmp-executables for magic awareness
|
2023-01-18 14:41:36 -05:00 |
|
Thomas Stromberg
|
f5e08ceec2
|
False positives: Chrome extensions, Steam games, tmp files, Photoshop
|
2023-01-18 14:10:33 -05:00 |
|
Thomas Strömberg
|
0ea1146cd5
|
Merge pull request #128 from tstromberg/fp3
False positives: homekit, setxid overflows, buildx, tmp, Messenger, etc
|
2023-01-18 10:58:46 -05:00 |
|
Thomas Stromberg
|
ef5d8afdd0
|
False positives: homekit, setxid overflows, buildx, tmp files
|
2023-01-18 10:57:43 -05:00 |
|
Thomas Stromberg
|
7b79b19090
|
False positive reduction: Messenger, Chrome, Final Cut Pro, etc
|
2023-01-18 09:49:56 -05:00 |
|
Thomas Strömberg
|
c6221f9d7b
|
Merge pull request #127 from tstromberg/fp3
FP removal: plymouth, 1Password, firejail, systemd, compile
|
2023-01-16 13:58:43 -05:00 |
|
Thomas Stromberg
|
09601ed3f0
|
Switch interval back to 300
|
2023-01-16 13:58:24 -05:00 |
|
Thomas Stromberg
|
5db432b2c6
|
Add compile (Go Lang) to exceptions list
|
2023-01-16 13:57:14 -05:00 |
|
Thomas Stromberg
|
42e9f2721b
|
FP removal: plymouth, 1Password, firejail, systemd
|
2023-01-16 13:55:53 -05:00 |
|
Thomas Strömberg
|
45e11c16ec
|
Merge pull request #126 from tstromberg/fp3
FP's: Selenium, polkit, gephi, docker-credential-gcloud, firejail, etc
|
2023-01-16 12:57:54 -05:00 |
|
Thomas Stromberg
|
d415b36b57
|
FP removal: Selenium, PolKit helper, gephi, docker-credential-gcloud, firejail, etc
|
2023-01-16 12:56:39 -05:00 |
|
Thomas Strömberg
|
9553b75f54
|
Merge pull request #125 from tstromberg/fp2
False positives: terraform, docker, qemu, aws, lima, etc.
|
2023-01-14 08:21:14 -05:00 |
|
Thomas Stromberg
|
431720103e
|
Remove dupe entry
|
2023-01-14 08:20:11 -05:00 |
|
Thomas Stromberg
|
e3401a07c6
|
Weekend false-positive flush
|
2023-01-14 08:19:26 -05:00 |
|
Thomas Strömberg
|
f3c1ce8533
|
Merge pull request #124 from tstromberg/fp2
Filter out new false positives
|
2023-01-13 15:24:57 -05:00 |
|
Thomas Stromberg
|
cb896b9e10
|
Filter out new false positives
|
2023-01-13 15:24:18 -05:00 |
|
Thomas Strömberg
|
68555e1b85
|
Merge pull request #123 from tstromberg/fp1
Friday False Positive Flush
|
2023-01-13 14:11:17 -05:00 |
|
Thomas Stromberg
|
1b79359b68
|
Friday False Positive Flush
|
2023-01-13 14:10:43 -05:00 |
|
Thomas Strömberg
|
0054ce7c3a
|
Merge pull request #122 from tstromberg/bugfixesJan13
Various query bugfixes from the 2022 macOS malware audit
|
2023-01-13 13:56:25 -05:00 |
|
Thomas Strömberg
|
cb0ed647d8
|
Merge branch 'main' into bugfixesJan13
|
2023-01-13 13:56:19 -05:00 |
|
Thomas Stromberg
|
9d7bd98875
|
Compare euid against process_events as processes may not join
|
2023-01-13 13:55:03 -05:00 |
|
Thomas Stromberg
|
edc9e4b527
|
Exclude _darwin_x paths in home
|
2023-01-13 13:54:28 -05:00 |
|
Thomas Stromberg
|
27dfda38ed
|
Remove whitelist for ~/Library and ~/.local
|
2023-01-13 13:54:04 -05:00 |
|
Thomas Stromberg
|
46024618f5
|
Fix regular expressions, include more commands
|
2023-01-13 13:50:37 -05:00 |
|
Thomas Stromberg
|
41e68657e9
|
Include more commands
|
2023-01-13 13:49:41 -05:00 |
|
Thomas Stromberg
|
4ec1581cc3
|
Also include binaries running from a hidden directory (1 deep)
|
2023-01-13 13:48:47 -05:00 |
|
Thomas Stromberg
|
00872b28bb
|
Speed query up by first referencing processes table
|
2023-01-13 13:48:22 -05:00 |
|
Thomas Stromberg
|
7073cde5f0
|
Allow chmod 0777 to match
|
2023-01-13 13:48:02 -05:00 |
|
Thomas Stromberg
|
1084843ed4
|
Add header metadata
|
2023-01-13 13:47:33 -05:00 |
|
Thomas Stromberg
|
c045daa8f9
|
Remove Python whitelist, see pymafka
|
2023-01-13 13:47:19 -05:00 |
|
Thomas Stromberg
|
dd3149a34b
|
Add support for .pkg files
|
2023-01-13 13:47:02 -05:00 |
|
Thomas Strömberg
|
6df2d80a75
|
Merge pull request #121 from tstromberg/security-framework
new detector: unexpected security framework program
|
2023-01-13 12:33:39 -05:00 |
|
Thomas Stromberg
|
92f2ce8f95
|
new detector: unexpected security framework program
|
2023-01-13 12:33:19 -05:00 |
|
Thomas Strömberg
|
f75d57d0f8
|
Merge pull request #120 from tstromberg/chmod
new detector: unexpected file made executable
|
2023-01-13 12:11:09 -05:00 |
|
Thomas Stromberg
|
36cac9722b
|
new detector: unexpected file made executable
|
2023-01-13 12:10:43 -05:00 |
|
Thomas Strömberg
|
e905881e58
|
Merge pull request #119 from tstromberg/xattr
new detector: unexpected xattr calls
|
2023-01-13 11:38:47 -05:00 |
|
Thomas Stromberg
|
53bc99da88
|
new detector: unexpected xattr calls
|
2023-01-13 11:38:19 -05:00 |
|
Thomas Strömberg
|
ff899f0bcb
|
Merge pull request #118 from tstromberg/service-accounts
new detector: unencrypted GCP service account keys
|
2023-01-13 11:22:23 -05:00 |
|
Thomas Stromberg
|
7b83467305
|
new detector: unencrypted GCP service account keys
|
2023-01-13 11:21:48 -05:00 |
|
Thomas Strömberg
|
81a6e99436
|
Merge pull request #117 from tstromberg/less-false2
Speed up unexpected-bpf-users query by basing it on processes
|
2023-01-09 15:19:08 -05:00 |
|
Thomas Stromberg
|
4000bac9f9
|
Speed up unexpected-bpf-users query by basing it on processes
|
2023-01-09 15:18:00 -05:00 |
|
Thomas Strömberg
|
b9a79aedf1
|
Merge pull request #116 from tstromberg/less-false2
Reformat and reduce false positives
|
2023-01-09 15:11:53 -05:00 |
|
Thomas Stromberg
|
420d269025
|
Reformat and reduce false positives
|
2023-01-09 15:10:48 -05:00 |
|
Thomas Stromberg
|
b6a34d4084
|
Add unpathed exception to sysctl.proc_translated, remove exception_key
|
2023-01-09 10:54:44 -05:00 |
|
Thomas Strömberg
|
814e11bdfd
|
Merge pull request #115 from tstromberg/less-false2
Remove false positives, fix queries that failed to show a parent pid
|
2023-01-09 10:47:19 -05:00 |
|
Thomas Stromberg
|
c7e4252af1
|
Remove false positives, fix some queries that failed to show a parent pid
|
2023-01-09 10:46:30 -05:00 |
|
Thomas Strömberg
|
1bd030a2f2
|
Merge pull request #114 from tstromberg/sysctl
new detector: unexpected sysctl calls
|
2023-01-09 09:36:01 -05:00 |
|
Thomas Stromberg
|
c495bfccac
|
new detector: unexpected sysctl calls
|
2023-01-09 09:35:17 -05:00 |
|
Thomas Strömberg
|
05721ed5c5
|
Merge pull request #113 from tstromberg/less-false
false positives + hashes: dots, ipn, apport-gtk, homebrew, hyperkey, contexts
|
2023-01-09 09:35:02 -05:00 |
|