Thomas Stromberg
|
92f2ce8f95
|
new detector: unexpected security framework program
|
2023-01-13 12:33:19 -05:00 |
|
Thomas Strömberg
|
f75d57d0f8
|
Merge pull request #120 from tstromberg/chmod
new detector: unexpected file made executable
|
2023-01-13 12:11:09 -05:00 |
|
Thomas Stromberg
|
36cac9722b
|
new detector: unexpected file made executable
|
2023-01-13 12:10:43 -05:00 |
|
Thomas Strömberg
|
e905881e58
|
Merge pull request #119 from tstromberg/xattr
new detector: unexpected xattr calls
|
2023-01-13 11:38:47 -05:00 |
|
Thomas Stromberg
|
53bc99da88
|
new detector: unexpected xattr calls
|
2023-01-13 11:38:19 -05:00 |
|
Thomas Strömberg
|
ff899f0bcb
|
Merge pull request #118 from tstromberg/service-accounts
new detector: unencrypted GCP service account keys
|
2023-01-13 11:22:23 -05:00 |
|
Thomas Stromberg
|
7b83467305
|
new detector: unencrypted GCP service account keys
|
2023-01-13 11:21:48 -05:00 |
|
Thomas Strömberg
|
81a6e99436
|
Merge pull request #117 from tstromberg/less-false2
Speed up unexpected-bpf-users query by basing it on processes
|
2023-01-09 15:19:08 -05:00 |
|
Thomas Stromberg
|
4000bac9f9
|
Speed up unexpected-bpf-users query by basing it on processes
|
2023-01-09 15:18:00 -05:00 |
|
Thomas Strömberg
|
b9a79aedf1
|
Merge pull request #116 from tstromberg/less-false2
Reformat and reduce false positives
|
2023-01-09 15:11:53 -05:00 |
|
Thomas Stromberg
|
420d269025
|
Reformat and reduce false positives
|
2023-01-09 15:10:48 -05:00 |
|
Thomas Stromberg
|
b6a34d4084
|
Add unpathed exception to sysctl.proc_translated, remove exception_key
|
2023-01-09 10:54:44 -05:00 |
|
Thomas Strömberg
|
814e11bdfd
|
Merge pull request #115 from tstromberg/less-false2
Remove false positives, fix queries that failed to show a parent pid
|
2023-01-09 10:47:19 -05:00 |
|
Thomas Stromberg
|
c7e4252af1
|
Remove false positives, fix some queries that failed to show a parent pid
|
2023-01-09 10:46:30 -05:00 |
|
Thomas Strömberg
|
1bd030a2f2
|
Merge pull request #114 from tstromberg/sysctl
new detector: unexpected sysctl calls
|
2023-01-09 09:36:01 -05:00 |
|
Thomas Stromberg
|
c495bfccac
|
new detector: unexpected sysctl calls
|
2023-01-09 09:35:17 -05:00 |
|
Thomas Strömberg
|
05721ed5c5
|
Merge pull request #113 from tstromberg/less-false
false positives + hashes: dots, ipn, apport-gtk, homebrew, hyperkey, contexts
|
2023-01-09 09:35:02 -05:00 |
|
Thomas Stromberg
|
e8af31a348
|
false positives: dots, ipn, apport-gtk, homebrew, hyperkey, contexts
|
2023-01-09 09:34:20 -05:00 |
|
Thomas Stromberg
|
a1fa72b1ba
|
Merge branch 'main' into less-false
|
2023-01-09 09:04:44 -05:00 |
|
Thomas Stromberg
|
2bcf9316cf
|
Add some hash fields, fix some false positives
|
2023-01-09 09:04:38 -05:00 |
|
Thomas Strömberg
|
7ce1e267f5
|
Merge pull request #112 from tstromberg/less-false
Catch up to some older false positives we ran into
|
2023-01-06 17:11:54 -05:00 |
|
Thomas Stromberg
|
4eb6993272
|
Catch up to some older false positives we ran into
|
2023-01-06 17:11:24 -05:00 |
|
Thomas Strömberg
|
ab17febfee
|
Merge pull request #111 from tstromberg/less-false
A few less false positives
|
2023-01-06 16:02:05 -05:00 |
|
Thomas Stromberg
|
1aefbe5e91
|
More false positive removal
|
2023-01-06 16:01:35 -05:00 |
|
Thomas Strömberg
|
a378f9a05f
|
Merge pull request #110 from tstromberg/shell-parent-events
Rewrite unexpected-osascript-calls for simplicity
|
2023-01-06 15:31:57 -05:00 |
|
Thomas Stromberg
|
cd0b7872c1
|
Rewrite unexpected-osascript-calls for simplicity
|
2023-01-06 15:31:08 -05:00 |
|
Thomas Strömberg
|
84711209a9
|
Merge pull request #109 from tstromberg/shell-parent-events
Fix more false positives, particularly in newer queries
|
2023-01-06 10:37:37 -05:00 |
|
Thomas Stromberg
|
05a39a78d3
|
Flush out more false positives across the stack
|
2023-01-06 10:36:48 -05:00 |
|
Thomas Stromberg
|
7455c22e3c
|
Fix missing /
|
2023-01-06 10:19:33 -05:00 |
|
Thomas Stromberg
|
9843def319
|
Fix more false positives, particularly in shell/fetcher parents
|
2023-01-06 10:18:19 -05:00 |
|
Thomas Strömberg
|
3db3559a7f
|
Merge pull request #108 from tstromberg/shell-parent-events
new detectors: unexpected shell & fetcher events
|
2023-01-04 15:49:36 -05:00 |
|
Thomas Stromberg
|
02881f7a0c
|
Remove empty line
|
2023-01-04 15:49:21 -05:00 |
|
Thomas Stromberg
|
9c512c5fd7
|
new detector: unexpected fetcher parents
|
2023-01-04 15:48:13 -05:00 |
|
Thomas Stromberg
|
1dbd98c57e
|
Add enough exceptions to make this useful
|
2023-01-04 11:58:54 -05:00 |
|
Thomas Stromberg
|
0ad0b3be8c
|
detection/initial_access/unexpected-shell-parent-events.sql
new detector: unexpected shell parent events
|
2023-01-04 11:43:26 -05:00 |
|
Thomas Strömberg
|
88e0e5fb57
|
Merge pull request #107 from tstromberg/root-signers
new detector: unexpected root process signer on macOS
|
2023-01-04 11:20:27 -05:00 |
|
Thomas Stromberg
|
64ed2bba02
|
new detector: software running as root on macOS with an unexpected authority
|
2023-01-04 11:19:44 -05:00 |
|
Thomas Strömberg
|
6f160c686d
|
Merge pull request #106 from tstromberg/relative-exec
New detector: relative exec low uid
|
2023-01-04 11:15:09 -05:00 |
|
Thomas Stromberg
|
ef3653216e
|
New detector: relative exec low uid
|
2023-01-04 11:14:04 -05:00 |
|
Thomas Strömberg
|
8c35d9c14a
|
Merge pull request #105 from tstromberg/bmw-of-greensboro
Catch up to other winter-break false positives
|
2023-01-04 11:09:59 -05:00 |
|
Thomas Stromberg
|
5735d87453
|
Add execdir exception for ~/%packages
|
2023-01-04 11:09:20 -05:00 |
|
Thomas Stromberg
|
71cda72dc1
|
Add exception for dmesg reading /dev/kmsg
|
2023-01-04 11:08:05 -05:00 |
|
Thomas Stromberg
|
aa7d9d21f7
|
Fix firefox typo
|
2023-01-04 11:05:03 -05:00 |
|
Thomas Stromberg
|
ba23df1fef
|
Catch up to other false positives over winter break
|
2023-01-04 11:03:38 -05:00 |
|
Thomas Strömberg
|
12acae7250
|
Merge pull request #104 from tstromberg/new-years
New Years FP cleanup: monitorix, snap-confine, steam, spotify, etc
|
2023-01-03 08:50:59 -05:00 |
|
Thomas Stromberg
|
a8b95a2c9e
|
New Years cleanup: monitorix, snap-confine, steam, spotify, etc
|
2023-01-03 08:50:19 -05:00 |
|
Thomas Strömberg
|
fd2b240344
|
Merge pull request #103 from tstromberg/sketchy-fetcher-refactor
sketchy fetchers: Remove trailing commas
|
2022-12-20 08:03:54 -05:00 |
|
Thomas Stromberg
|
44ca59c9d6
|
sketchy fetchers: Remove trailing commas
|
2022-12-20 08:03:14 -05:00 |
|
Thomas Strömberg
|
a6a8c28448
|
Merge pull request #102 from tstromberg/sketchy-fetcher-refactor
sketchy fetcher: Add grandparents and TLD detector
|
2022-12-20 07:54:17 -05:00 |
|
Thomas Strömberg
|
45cbb3e731
|
Merge pull request #101 from tstromberg/parent-missing
parent-missing-from-disk: Filter out Docker children too
|
2022-12-20 07:54:10 -05:00 |
|