Commit Graph

570 Commits

Author SHA1 Message Date
Thomas Stromberg
dc154a6199
FPR: Meta Pixel Helper, systemctl, pia-daemon, 1Passwd, iTerm, Brave 2023-01-20 09:04:00 -05:00
Thomas Stromberg
8e9ae0fda3
Less false positives: particularly among systemctl calls 2023-01-20 08:40:08 -05:00
Thomas Stromberg
3de05139e3
Merge branch 'main' into fp4 2023-01-19 12:18:29 -05:00
Thomas Stromberg
b601d6c3b0
Add port 19305 (Google Meet) on Firefox 2023-01-19 12:18:22 -05:00
Thomas Stromberg
67fb9cad14
Remove false positive: apt-helper calls to systemctl 2023-01-19 12:16:20 -05:00
Thomas Strömberg
b9ea18e50f
Merge pull request #135 from tstromberg/fp4
Increase long uptime cutoff from 60d to 90d
2023-01-19 12:11:52 -05:00
Thomas Stromberg
0b057b45d2
Increase long uptime cutoff from 60d to 90d 2023-01-19 12:11:01 -05:00
Thomas Strömberg
8a9ad0d8cb
Merge pull request #134 from tstromberg/fp4
False positives: apt-daily, github runner, Slack helper, Foxit, syncthing
2023-01-19 11:52:56 -05:00
Thomas Stromberg
710ca28ed9
False positives: apt-daily, github runner, Slack helper, Foxit, syncthing 2023-01-19 11:52:31 -05:00
Thomas Strömberg
e3852a1e1f
Merge pull request #133 from tstromberg/net-parents
Add more paths to unexpected-hidden-system-paths, rename
2023-01-19 11:43:18 -05:00
Thomas Stromberg
a100aa307f
Add more paths to unexpected-hidden-system-paths, rename 2023-01-19 11:42:44 -05:00
Thomas Strömberg
22b2594d58
Merge pull request #132 from tstromberg/net-parents
old binaries: fix errant mtime comparison
2023-01-19 11:42:19 -05:00
Thomas Stromberg
5abe66644b
old binaries: fix errant mtime comparison 2023-01-19 11:42:00 -05:00
Thomas Strömberg
0027df2995
Merge pull request #131 from tstromberg/net-parents
New detector: unexpected systemctl calls
2023-01-19 11:41:29 -05:00
Thomas Stromberg
24bdaa243a
New detector: unexpected systemctl calls 2023-01-19 11:39:52 -05:00
Thomas Strömberg
720ccbe4e4
Merge pull request #130 from tstromberg/net-parents
New detector: unexpected netutil calls
2023-01-19 11:39:27 -05:00
Thomas Stromberg
2f8cca819b
New detectors: unexpected netutil calls 2023-01-19 11:39:02 -05:00
Thomas Strömberg
8325325996
Merge pull request #129 from tstromberg/fp3
False positives: Chrome extensions, Steam games, tmp files, Photoshop
2023-01-18 14:42:10 -05:00
Thomas Stromberg
5c421f7c96
Refactor unexpected-tmp-executables for magic awareness 2023-01-18 14:41:36 -05:00
Thomas Stromberg
f5e08ceec2
False positives: Chrome extensions, Steam games, tmp files, Photoshop 2023-01-18 14:10:33 -05:00
Thomas Strömberg
0ea1146cd5
Merge pull request #128 from tstromberg/fp3
False positives: homekit, setxid overflows, buildx, tmp, Messenger, etc
2023-01-18 10:58:46 -05:00
Thomas Stromberg
ef5d8afdd0
False positives: homekit, setxid overflows, buildx, tmp files 2023-01-18 10:57:43 -05:00
Thomas Stromberg
7b79b19090
False positive reduction: Messenger, Chrome, Final Cut Pro, etc 2023-01-18 09:49:56 -05:00
Thomas Strömberg
c6221f9d7b
Merge pull request #127 from tstromberg/fp3
FP removal: plymouth, 1Password, firejail, systemd, compile
2023-01-16 13:58:43 -05:00
Thomas Stromberg
09601ed3f0
Switch interval back to 300 2023-01-16 13:58:24 -05:00
Thomas Stromberg
5db432b2c6
Add compile (Go Lang) to exceptions list 2023-01-16 13:57:14 -05:00
Thomas Stromberg
42e9f2721b
FP removal: plymouth, 1Password, firejail, systemd 2023-01-16 13:55:53 -05:00
Thomas Strömberg
45e11c16ec
Merge pull request #126 from tstromberg/fp3
FP's: Selenium, polkit, gephi, docker-credential-gcloud, firejail, etc
2023-01-16 12:57:54 -05:00
Thomas Stromberg
d415b36b57
FP removal: Selenium, PolKit helper, gephi, docker-credential-gcloud, firejail, etc 2023-01-16 12:56:39 -05:00
Thomas Strömberg
9553b75f54
Merge pull request #125 from tstromberg/fp2
False positives: terraform, docker, qemu, aws, lima, etc.
2023-01-14 08:21:14 -05:00
Thomas Stromberg
431720103e
Remove dupe entry 2023-01-14 08:20:11 -05:00
Thomas Stromberg
e3401a07c6
Weekend false-positive flush 2023-01-14 08:19:26 -05:00
Thomas Strömberg
f3c1ce8533
Merge pull request #124 from tstromberg/fp2
Filter out new false positives
2023-01-13 15:24:57 -05:00
Thomas Stromberg
cb896b9e10
Filter out new false positives 2023-01-13 15:24:18 -05:00
Thomas Strömberg
68555e1b85
Merge pull request #123 from tstromberg/fp1
Friday False Positive Flush
2023-01-13 14:11:17 -05:00
Thomas Stromberg
1b79359b68
Friday False Positive Flush 2023-01-13 14:10:43 -05:00
Thomas Strömberg
0054ce7c3a
Merge pull request #122 from tstromberg/bugfixesJan13
Various query bugfixes from the 2022 macOS malware audit
2023-01-13 13:56:25 -05:00
Thomas Strömberg
cb0ed647d8
Merge branch 'main' into bugfixesJan13 2023-01-13 13:56:19 -05:00
Thomas Stromberg
9d7bd98875
Compare euid against process_events as processes may not join 2023-01-13 13:55:03 -05:00
Thomas Stromberg
edc9e4b527
Exclude _darwin_x paths in home 2023-01-13 13:54:28 -05:00
Thomas Stromberg
27dfda38ed
Remove whitelist for ~/Library and ~/.local 2023-01-13 13:54:04 -05:00
Thomas Stromberg
46024618f5
Fix regular expressions, include more commands 2023-01-13 13:50:37 -05:00
Thomas Stromberg
41e68657e9
Include more commands 2023-01-13 13:49:41 -05:00
Thomas Stromberg
4ec1581cc3
Also include binaries running from a hidden directory (1 deep) 2023-01-13 13:48:47 -05:00
Thomas Stromberg
00872b28bb
Speed query up by first referencing processes table 2023-01-13 13:48:22 -05:00
Thomas Stromberg
7073cde5f0
Allow chmod 0777 to match 2023-01-13 13:48:02 -05:00
Thomas Stromberg
1084843ed4
Add header metadata 2023-01-13 13:47:33 -05:00
Thomas Stromberg
c045daa8f9
Remove Python whitelist, see pymafka 2023-01-13 13:47:19 -05:00
Thomas Stromberg
dd3149a34b
Add support for .pkg files 2023-01-13 13:47:02 -05:00
Thomas Strömberg
6df2d80a75
Merge pull request #121 from tstromberg/security-framework
new detector: unexpected security framework program
2023-01-13 12:33:39 -05:00