Thomas Stromberg
|
dc154a6199
|
FPR: Meta Pixel Helper, systemctl, pia-daemon, 1Passwd, iTerm, Brave
|
2023-01-20 09:04:00 -05:00 |
|
Thomas Stromberg
|
8e9ae0fda3
|
Less false positives: particularly among systemctl calls
|
2023-01-20 08:40:08 -05:00 |
|
Thomas Stromberg
|
3de05139e3
|
Merge branch 'main' into fp4
|
2023-01-19 12:18:29 -05:00 |
|
Thomas Stromberg
|
b601d6c3b0
|
Add port 19305 (Google Meet) on Firefox
|
2023-01-19 12:18:22 -05:00 |
|
Thomas Stromberg
|
67fb9cad14
|
Remove false positive: apt-helper calls to systemctl
|
2023-01-19 12:16:20 -05:00 |
|
Thomas Strömberg
|
b9ea18e50f
|
Merge pull request #135 from tstromberg/fp4
Increase long uptime cutoff from 60d to 90d
|
2023-01-19 12:11:52 -05:00 |
|
Thomas Stromberg
|
0b057b45d2
|
Increase long uptime cutoff from 60d to 90d
|
2023-01-19 12:11:01 -05:00 |
|
Thomas Strömberg
|
8a9ad0d8cb
|
Merge pull request #134 from tstromberg/fp4
False positives: apt-daily, github runner, Slack helper, Foxit, syncthing
|
2023-01-19 11:52:56 -05:00 |
|
Thomas Stromberg
|
710ca28ed9
|
False positives: apt-daily, github runner, Slack helper, Foxit, syncthing
|
2023-01-19 11:52:31 -05:00 |
|
Thomas Strömberg
|
e3852a1e1f
|
Merge pull request #133 from tstromberg/net-parents
Add more paths to unexpected-hidden-system-paths, rename
|
2023-01-19 11:43:18 -05:00 |
|
Thomas Stromberg
|
a100aa307f
|
Add more paths to unexpected-hidden-system-paths, rename
|
2023-01-19 11:42:44 -05:00 |
|
Thomas Strömberg
|
22b2594d58
|
Merge pull request #132 from tstromberg/net-parents
old binaries: fix errant mtime comparison
|
2023-01-19 11:42:19 -05:00 |
|
Thomas Stromberg
|
5abe66644b
|
old binaries: fix errant mtime comparison
|
2023-01-19 11:42:00 -05:00 |
|
Thomas Strömberg
|
0027df2995
|
Merge pull request #131 from tstromberg/net-parents
New detector: unexpected systemctl calls
|
2023-01-19 11:41:29 -05:00 |
|
Thomas Stromberg
|
24bdaa243a
|
New detector: unexpected systemctl calls
|
2023-01-19 11:39:52 -05:00 |
|
Thomas Strömberg
|
720ccbe4e4
|
Merge pull request #130 from tstromberg/net-parents
New detector: unexpected netutil calls
|
2023-01-19 11:39:27 -05:00 |
|
Thomas Stromberg
|
2f8cca819b
|
New detectors: unexpected netutil calls
|
2023-01-19 11:39:02 -05:00 |
|
Thomas Strömberg
|
8325325996
|
Merge pull request #129 from tstromberg/fp3
False positives: Chrome extensions, Steam games, tmp files, Photoshop
|
2023-01-18 14:42:10 -05:00 |
|
Thomas Stromberg
|
5c421f7c96
|
Refactor unexpected-tmp-executables for magic awareness
|
2023-01-18 14:41:36 -05:00 |
|
Thomas Stromberg
|
f5e08ceec2
|
False positives: Chrome extensions, Steam games, tmp files, Photoshop
|
2023-01-18 14:10:33 -05:00 |
|
Thomas Strömberg
|
0ea1146cd5
|
Merge pull request #128 from tstromberg/fp3
False positives: homekit, setxid overflows, buildx, tmp, Messenger, etc
|
2023-01-18 10:58:46 -05:00 |
|
Thomas Stromberg
|
ef5d8afdd0
|
False positives: homekit, setxid overflows, buildx, tmp files
|
2023-01-18 10:57:43 -05:00 |
|
Thomas Stromberg
|
7b79b19090
|
False positive reduction: Messenger, Chrome, Final Cut Pro, etc
|
2023-01-18 09:49:56 -05:00 |
|
Thomas Strömberg
|
c6221f9d7b
|
Merge pull request #127 from tstromberg/fp3
FP removal: plymouth, 1Password, firejail, systemd, compile
|
2023-01-16 13:58:43 -05:00 |
|
Thomas Stromberg
|
09601ed3f0
|
Switch interval back to 300
|
2023-01-16 13:58:24 -05:00 |
|
Thomas Stromberg
|
5db432b2c6
|
Add compile (Go Lang) to exceptions list
|
2023-01-16 13:57:14 -05:00 |
|
Thomas Stromberg
|
42e9f2721b
|
FP removal: plymouth, 1Password, firejail, systemd
|
2023-01-16 13:55:53 -05:00 |
|
Thomas Strömberg
|
45e11c16ec
|
Merge pull request #126 from tstromberg/fp3
FP's: Selenium, polkit, gephi, docker-credential-gcloud, firejail, etc
|
2023-01-16 12:57:54 -05:00 |
|
Thomas Stromberg
|
d415b36b57
|
FP removal: Selenium, PolKit helper, gephi, docker-credential-gcloud, firejail, etc
|
2023-01-16 12:56:39 -05:00 |
|
Thomas Strömberg
|
9553b75f54
|
Merge pull request #125 from tstromberg/fp2
False positives: terraform, docker, qemu, aws, lima, etc.
|
2023-01-14 08:21:14 -05:00 |
|
Thomas Stromberg
|
431720103e
|
Remove dupe entry
|
2023-01-14 08:20:11 -05:00 |
|
Thomas Stromberg
|
e3401a07c6
|
Weekend false-positive flush
|
2023-01-14 08:19:26 -05:00 |
|
Thomas Strömberg
|
f3c1ce8533
|
Merge pull request #124 from tstromberg/fp2
Filter out new false positives
|
2023-01-13 15:24:57 -05:00 |
|
Thomas Stromberg
|
cb896b9e10
|
Filter out new false positives
|
2023-01-13 15:24:18 -05:00 |
|
Thomas Strömberg
|
68555e1b85
|
Merge pull request #123 from tstromberg/fp1
Friday False Positive Flush
|
2023-01-13 14:11:17 -05:00 |
|
Thomas Stromberg
|
1b79359b68
|
Friday False Positive Flush
|
2023-01-13 14:10:43 -05:00 |
|
Thomas Strömberg
|
0054ce7c3a
|
Merge pull request #122 from tstromberg/bugfixesJan13
Various query bugfixes from the 2022 macOS malware audit
|
2023-01-13 13:56:25 -05:00 |
|
Thomas Strömberg
|
cb0ed647d8
|
Merge branch 'main' into bugfixesJan13
|
2023-01-13 13:56:19 -05:00 |
|
Thomas Stromberg
|
9d7bd98875
|
Compare euid against process_events as processes may not join
|
2023-01-13 13:55:03 -05:00 |
|
Thomas Stromberg
|
edc9e4b527
|
Exclude _darwin_x paths in home
|
2023-01-13 13:54:28 -05:00 |
|
Thomas Stromberg
|
27dfda38ed
|
Remove whitelist for ~/Library and ~/.local
|
2023-01-13 13:54:04 -05:00 |
|
Thomas Stromberg
|
46024618f5
|
Fix regular expressions, include more commands
|
2023-01-13 13:50:37 -05:00 |
|
Thomas Stromberg
|
41e68657e9
|
Include more commands
|
2023-01-13 13:49:41 -05:00 |
|
Thomas Stromberg
|
4ec1581cc3
|
Also include binaries running from a hidden directory (1 deep)
|
2023-01-13 13:48:47 -05:00 |
|
Thomas Stromberg
|
00872b28bb
|
Speed query up by first referencing processes table
|
2023-01-13 13:48:22 -05:00 |
|
Thomas Stromberg
|
7073cde5f0
|
Allow chmod 0777 to match
|
2023-01-13 13:48:02 -05:00 |
|
Thomas Stromberg
|
1084843ed4
|
Add header metadata
|
2023-01-13 13:47:33 -05:00 |
|
Thomas Stromberg
|
c045daa8f9
|
Remove Python whitelist, see pymafka
|
2023-01-13 13:47:19 -05:00 |
|
Thomas Stromberg
|
dd3149a34b
|
Add support for .pkg files
|
2023-01-13 13:47:02 -05:00 |
|
Thomas Strömberg
|
6df2d80a75
|
Merge pull request #121 from tstromberg/security-framework
new detector: unexpected security framework program
|
2023-01-13 12:33:39 -05:00 |
|