Commit Graph

617 Commits

Author SHA1 Message Date
Thomas Stromberg
d039449330
Add new Kolide signing authority as a valid talker 2023-02-02 19:50:13 -05:00
Thomas Strömberg
561a7511da
Merge pull request #154 from tstromberg/macos-bugs
macOS: Add exceptions for AppleInstallType.plist & osquery
2023-02-02 16:36:36 -05:00
Thomas Stromberg
ccf7ba413e
macOS: Add exceptions for AppleInstallType.plist & osquery 2023-02-02 16:36:17 -05:00
Thomas Strömberg
79c88e6b94
Merge pull request #153 from tstromberg/macos-bugs
Fix broken macOS queries & include new macOS fragments
2023-02-02 15:34:00 -05:00
Thomas Stromberg
2093a26423
Fix broken macOS queries 2023-02-02 15:33:25 -05:00
Thomas Strömberg
afec68cd33
Merge pull request #152 from tstromberg/new-osqtool
Update configuration for osqtool v1.0
2023-02-02 12:05:02 -05:00
Thomas Stromberg
2d81061df3
Update for osqtool v1.0 2023-02-02 12:04:26 -05:00
Thomas Strömberg
fd1b5d28c4
Merge pull request #151 from tstromberg/perf-analysis
Tune queries to decrease CPU overhead on macOS
2023-02-01 16:18:54 -05:00
Thomas Stromberg
cdcb2d48f3
Slow queries down, minor improvements 2023-02-01 16:17:36 -05:00
Thomas Stromberg
393b83168f
Merge to head 2023-02-01 15:11:51 -05:00
Thomas Stromberg
23f436f906
Minor perf improvements for macOS queries 2023-02-01 15:06:58 -05:00
Thomas Strömberg
97a3661e1d
Merge pull request #150 from tstromberg/fp4
Include more process information across queries
2023-02-01 13:57:04 -05:00
Thomas Stromberg
f9dce0a72d
Include more process information across queries 2023-02-01 13:55:55 -05:00
Thomas Strömberg
3ee82708c8
Merge pull request #149 from tstromberg/fp4
Fix typo with zed entry
2023-01-30 15:02:06 -05:00
Thomas Stromberg
bc2cde9673
Fix typo with zed entry 2023-01-30 15:01:21 -05:00
Thomas Strömberg
825552bec4
Merge pull request #148 from tstromberg/fp4
fpr: Chrome exts, vbox, chrome, gcloud, gdm3, yay, hangouts, etc
2023-01-30 14:59:28 -05:00
Thomas Stromberg
45ab183557
fpr: New Chrome etxensions, vbox, chrome, gcloud, gdm3, yay, etc 2023-01-30 14:58:47 -05:00
Thomas Stromberg
5621d9ecd1
Add exception for wrapped Firefox talking to port 19305 (Hangouts) 2023-01-27 10:41:55 -05:00
Thomas Strömberg
fbb452c564
Merge pull request #147 from tstromberg/fp4
Include possible sources in unexpected-volume-names, reduce false positives
2023-01-27 10:39:10 -05:00
Thomas Stromberg
141ab28310
False positives: autodocs, jupyter, apko 2023-01-27 10:38:01 -05:00
Thomas Stromberg
bd9320acfa
Include possible volume sources 2023-01-27 10:36:37 -05:00
Thomas Strömberg
69b9734c56
Merge pull request #146 from tstromberg/fp4
Remove unused active fields, add WhatsApp ioreg exception
2023-01-27 08:47:26 -05:00
Thomas Stromberg
66ee3484c0
Remove unused active fields, add WhatsApp ioreg exception 2023-01-27 08:46:48 -05:00
Thomas Strömberg
508f254896
Merge pull request #145 from tstromberg/fp4
Make unexpected-chrome-extensions easier to maintain, address false-positives
2023-01-26 20:41:47 -05:00
Thomas Stromberg
d51bd731a1
fpr: Parallels, nerdctl, Xorg, nvidia, Stream, etc 2023-01-26 20:40:47 -05:00
Thomas Stromberg
b671e30fce
Simplify unexpected-chrome-extensions exceptions for maintainability 2023-01-26 20:40:22 -05:00
Thomas Stromberg
7d8fa35eb4
fpr: Github Absolute Date, Snagit, Figma, Seagate, aws, etc 2023-01-26 16:30:14 -05:00
Thomas Strömberg
1b541f402e
Merge pull request #144 from tstromberg/fp4
Refactor process_events queries, improve shlayer detection, fix fps
2023-01-26 11:42:14 -05:00
Thomas Stromberg
f5fe9a4aac
Refactor process_events queries for more accurate parenting 2023-01-26 11:40:54 -05:00
Thomas Strömberg
b435a2055c
Merge pull request #143 from tstromberg/fp4
fpr: minikube, tailscale, dex, pacman, virtualbox, steam, lsmod, busybox, kue, libinput, etc
2023-01-23 20:34:31 -05:00
Thomas Stromberg
83cc38207e
fpr: minikube, tailscale, dex, pacman, virtualbox, steam, lsmod, busybox, etc 2023-01-23 20:33:52 -05:00
Thomas Stromberg
f7c1557aee
fpr: libinput, kue, updatedb, mariadb, terraform 2023-01-23 08:13:04 -05:00
Thomas Strömberg
cb159eeca1
Merge pull request #142 from tstromberg/fp4
More exceptions for JetBrains & Github Runners
2023-01-20 17:56:11 -05:00
Thomas Stromberg
280b187b20
fpr: systemctl calls, go tests, WebEx, MariaDB, Brave 2023-01-20 17:55:48 -05:00
Thomas Stromberg
d55bd17154
listening ports: Add goland exception 2023-01-20 10:00:40 -05:00
Thomas Stromberg
6858bb29eb
framework: Add exception for github runner 2023-01-20 09:59:43 -05:00
Thomas Stromberg
045b8ea524
execdir: exception for JetBrains 2023-01-20 09:57:12 -05:00
Thomas Strömberg
27362ff966
Merge pull request #141 from tstromberg/fp4
Add more examples of legit executables, namely ibus-* and *Manager
2023-01-20 09:30:16 -05:00
Thomas Stromberg
29d563f2df
Add more examples of legit executables, namely ibus-* and *Manager 2023-01-20 09:29:10 -05:00
Thomas Strömberg
e0026e6f03
Merge pull request #140 from tstromberg/fp4
Run 'make reformat'
2023-01-20 09:24:52 -05:00
Thomas Stromberg
e6824d87e9
Run 'make reformat' 2023-01-20 09:24:24 -05:00
Thomas Strömberg
21a376326f
Merge pull request #139 from tstromberg/fp4
Fp4
2023-01-20 09:23:42 -05:00
Thomas Stromberg
e13773d9b7
Add fish & bash to parent missing disk exclusions 2023-01-20 09:08:45 -05:00
Thomas Stromberg
6014ca1e64
Add missing comma 2023-01-20 09:06:21 -05:00
Thomas Strömberg
5e7fa2d578
Merge pull request #138 from tstromberg/fp4
FPR: Meta Pixel Helper, systemctl, pia-daemon, 1Passwd, iTerm, Brave
2023-01-20 09:04:41 -05:00
Thomas Stromberg
dc154a6199
FPR: Meta Pixel Helper, systemctl, pia-daemon, 1Passwd, iTerm, Brave 2023-01-20 09:04:00 -05:00
Thomas Strömberg
2d53fe6dfb
Merge pull request #137 from tstromberg/fp4
Less false positives: particularly among systemctl calls
2023-01-20 08:40:59 -05:00
Thomas Stromberg
8e9ae0fda3
Less false positives: particularly among systemctl calls 2023-01-20 08:40:08 -05:00
Thomas Strömberg
4277f65ee3
Merge pull request #136 from tstromberg/fp4
Remove false positive: apt-helper calls to systemctl
2023-01-19 12:18:44 -05:00
Thomas Stromberg
3de05139e3
Merge branch 'main' into fp4 2023-01-19 12:18:29 -05:00