586 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Thomas Strömberg	68555e1b85	Merge pull request #123 from tstromberg/fp1 ... Friday False Positive Flush	2023-01-13 14:11:17 -05:00
Thomas Stromberg	1b79359b68	Friday False Positive Flush	2023-01-13 14:10:43 -05:00
Thomas Strömberg	0054ce7c3a	Merge pull request #122 from tstromberg/bugfixesJan13 ... Various query bugfixes from the 2022 macOS malware audit	2023-01-13 13:56:25 -05:00
Thomas Strömberg	cb0ed647d8	Merge branch 'main' into bugfixesJan13	2023-01-13 13:56:19 -05:00
Thomas Stromberg	9d7bd98875	Compare euid against process_events as processes may not join	2023-01-13 13:55:03 -05:00
Thomas Stromberg	edc9e4b527	Exclude _darwin_x paths in home	2023-01-13 13:54:28 -05:00
Thomas Stromberg	27dfda38ed	Remove whitelist for ~/Library and ~/.local	2023-01-13 13:54:04 -05:00
Thomas Stromberg	46024618f5	Fix regular expressions, include more commands	2023-01-13 13:50:37 -05:00
Thomas Stromberg	41e68657e9	Include more commands	2023-01-13 13:49:41 -05:00
Thomas Stromberg	4ec1581cc3	Also include binaries running from a hidden directory (1 deep)	2023-01-13 13:48:47 -05:00
Thomas Stromberg	00872b28bb	Speed query up by first referencing processes table	2023-01-13 13:48:22 -05:00
Thomas Stromberg	7073cde5f0	Allow chmod 0777 to match	2023-01-13 13:48:02 -05:00
Thomas Stromberg	1084843ed4	Add header metadata	2023-01-13 13:47:33 -05:00
Thomas Stromberg	c045daa8f9	Remove Python whitelist, see pymafka	2023-01-13 13:47:19 -05:00
Thomas Stromberg	dd3149a34b	Add support for .pkg files	2023-01-13 13:47:02 -05:00
Thomas Strömberg	6df2d80a75	Merge pull request #121 from tstromberg/security-framework ... new detector: unexpected security framework program	2023-01-13 12:33:39 -05:00
Thomas Stromberg	92f2ce8f95	new detector: unexpected security framework program	2023-01-13 12:33:19 -05:00
Thomas Strömberg	f75d57d0f8	Merge pull request #120 from tstromberg/chmod ... new detector: unexpected file made executable	2023-01-13 12:11:09 -05:00
Thomas Stromberg	36cac9722b	new detector: unexpected file made executable	2023-01-13 12:10:43 -05:00
Thomas Strömberg	e905881e58	Merge pull request #119 from tstromberg/xattr ... new detector: unexpected xattr calls	2023-01-13 11:38:47 -05:00
Thomas Stromberg	53bc99da88	new detector: unexpected xattr calls	2023-01-13 11:38:19 -05:00
Thomas Strömberg	ff899f0bcb	Merge pull request #118 from tstromberg/service-accounts ... new detector: unencrypted GCP service account keys	2023-01-13 11:22:23 -05:00
Thomas Stromberg	7b83467305	new detector: unencrypted GCP service account keys	2023-01-13 11:21:48 -05:00
Thomas Strömberg	81a6e99436	Merge pull request #117 from tstromberg/less-false2 ... Speed up unexpected-bpf-users query by basing it on processes	2023-01-09 15:19:08 -05:00
Thomas Stromberg	4000bac9f9	Speed up unexpected-bpf-users query by basing it on processes	2023-01-09 15:18:00 -05:00
Thomas Strömberg	b9a79aedf1	Merge pull request #116 from tstromberg/less-false2 ... Reformat and reduce false positives	2023-01-09 15:11:53 -05:00
Thomas Stromberg	420d269025	Reformat and reduce false positives	2023-01-09 15:10:48 -05:00
Thomas Stromberg	b6a34d4084	Add unpathed exception to sysctl.proc_translated, remove exception_key	2023-01-09 10:54:44 -05:00
Thomas Strömberg	814e11bdfd	Merge pull request #115 from tstromberg/less-false2 ... Remove false positives, fix queries that failed to show a parent pid	2023-01-09 10:47:19 -05:00
Thomas Stromberg	c7e4252af1	Remove false positives, fix some queries that failed to show a parent pid	2023-01-09 10:46:30 -05:00
Thomas Strömberg	1bd030a2f2	Merge pull request #114 from tstromberg/sysctl ... new detector: unexpected sysctl calls	2023-01-09 09:36:01 -05:00
Thomas Stromberg	c495bfccac	new detector: unexpected sysctl calls	2023-01-09 09:35:17 -05:00
Thomas Strömberg	05721ed5c5	Merge pull request #113 from tstromberg/less-false ... false positives + hashes: dots, ipn, apport-gtk, homebrew, hyperkey, contexts	2023-01-09 09:35:02 -05:00
Thomas Stromberg	e8af31a348	false positives: dots, ipn, apport-gtk, homebrew, hyperkey, contexts	2023-01-09 09:34:20 -05:00
Thomas Stromberg	a1fa72b1ba	Merge branch 'main' into less-false	2023-01-09 09:04:44 -05:00
Thomas Stromberg	2bcf9316cf	Add some hash fields, fix some false positives	2023-01-09 09:04:38 -05:00
Thomas Strömberg	7ce1e267f5	Merge pull request #112 from tstromberg/less-false ... Catch up to some older false positives we ran into	2023-01-06 17:11:54 -05:00
Thomas Stromberg	4eb6993272	Catch up to some older false positives we ran into	2023-01-06 17:11:24 -05:00
Thomas Strömberg	ab17febfee	Merge pull request #111 from tstromberg/less-false ... A few less false positives	2023-01-06 16:02:05 -05:00
Thomas Stromberg	1aefbe5e91	More false positive removal	2023-01-06 16:01:35 -05:00
Thomas Strömberg	a378f9a05f	Merge pull request #110 from tstromberg/shell-parent-events ... Rewrite unexpected-osascript-calls for simplicity	2023-01-06 15:31:57 -05:00
Thomas Stromberg	cd0b7872c1	Rewrite unexpected-osascript-calls for simplicity	2023-01-06 15:31:08 -05:00
Thomas Strömberg	84711209a9	Merge pull request #109 from tstromberg/shell-parent-events ... Fix more false positives, particularly in newer queries	2023-01-06 10:37:37 -05:00
Thomas Stromberg	05a39a78d3	Flush out more false positives across the stack	2023-01-06 10:36:48 -05:00
Thomas Stromberg	7455c22e3c	Fix missing /	2023-01-06 10:19:33 -05:00
Thomas Stromberg	9843def319	Fix more false positives, particularly in shell/fetcher parents	2023-01-06 10:18:19 -05:00
Thomas Strömberg	3db3559a7f	Merge pull request #108 from tstromberg/shell-parent-events ... new detectors: unexpected shell & fetcher events	2023-01-04 15:49:36 -05:00
Thomas Stromberg	02881f7a0c	Remove empty line	2023-01-04 15:49:21 -05:00
Thomas Stromberg	9c512c5fd7	new detector: unexpected fetcher parents	2023-01-04 15:48:13 -05:00
Thomas Stromberg	1dbd98c57e	Add enough exceptions to make this useful	2023-01-04 11:58:54 -05:00