Commit Graph

570 Commits

Author SHA1 Message Date
Thomas Stromberg
92f2ce8f95
new detector: unexpected security framework program 2023-01-13 12:33:19 -05:00
Thomas Strömberg
f75d57d0f8
Merge pull request #120 from tstromberg/chmod
new detector: unexpected file made executable
2023-01-13 12:11:09 -05:00
Thomas Stromberg
36cac9722b
new detector: unexpected file made executable 2023-01-13 12:10:43 -05:00
Thomas Strömberg
e905881e58
Merge pull request #119 from tstromberg/xattr
new detector: unexpected xattr calls
2023-01-13 11:38:47 -05:00
Thomas Stromberg
53bc99da88
new detector: unexpected xattr calls 2023-01-13 11:38:19 -05:00
Thomas Strömberg
ff899f0bcb
Merge pull request #118 from tstromberg/service-accounts
new detector: unencrypted GCP service account keys
2023-01-13 11:22:23 -05:00
Thomas Stromberg
7b83467305
new detector: unencrypted GCP service account keys 2023-01-13 11:21:48 -05:00
Thomas Strömberg
81a6e99436
Merge pull request #117 from tstromberg/less-false2
Speed up unexpected-bpf-users query by basing it on processes
2023-01-09 15:19:08 -05:00
Thomas Stromberg
4000bac9f9
Speed up unexpected-bpf-users query by basing it on processes 2023-01-09 15:18:00 -05:00
Thomas Strömberg
b9a79aedf1
Merge pull request #116 from tstromberg/less-false2
Reformat and reduce false positives
2023-01-09 15:11:53 -05:00
Thomas Stromberg
420d269025
Reformat and reduce false positives 2023-01-09 15:10:48 -05:00
Thomas Stromberg
b6a34d4084
Add unpathed exception to sysctl.proc_translated, remove exception_key 2023-01-09 10:54:44 -05:00
Thomas Strömberg
814e11bdfd
Merge pull request #115 from tstromberg/less-false2
Remove false positives, fix queries that failed to show a parent pid
2023-01-09 10:47:19 -05:00
Thomas Stromberg
c7e4252af1
Remove false positives, fix some queries that failed to show a parent pid 2023-01-09 10:46:30 -05:00
Thomas Strömberg
1bd030a2f2
Merge pull request #114 from tstromberg/sysctl
new detector: unexpected sysctl calls
2023-01-09 09:36:01 -05:00
Thomas Stromberg
c495bfccac
new detector: unexpected sysctl calls 2023-01-09 09:35:17 -05:00
Thomas Strömberg
05721ed5c5
Merge pull request #113 from tstromberg/less-false
false positives + hashes: dots, ipn, apport-gtk, homebrew, hyperkey, contexts
2023-01-09 09:35:02 -05:00
Thomas Stromberg
e8af31a348
false positives: dots, ipn, apport-gtk, homebrew, hyperkey, contexts 2023-01-09 09:34:20 -05:00
Thomas Stromberg
a1fa72b1ba
Merge branch 'main' into less-false 2023-01-09 09:04:44 -05:00
Thomas Stromberg
2bcf9316cf
Add some hash fields, fix some false positives 2023-01-09 09:04:38 -05:00
Thomas Strömberg
7ce1e267f5
Merge pull request #112 from tstromberg/less-false
Catch up to some older false positives we ran into
2023-01-06 17:11:54 -05:00
Thomas Stromberg
4eb6993272
Catch up to some older false positives we ran into 2023-01-06 17:11:24 -05:00
Thomas Strömberg
ab17febfee
Merge pull request #111 from tstromberg/less-false
A few less false positives
2023-01-06 16:02:05 -05:00
Thomas Stromberg
1aefbe5e91
More false positive removal 2023-01-06 16:01:35 -05:00
Thomas Strömberg
a378f9a05f
Merge pull request #110 from tstromberg/shell-parent-events
Rewrite unexpected-osascript-calls for simplicity
2023-01-06 15:31:57 -05:00
Thomas Stromberg
cd0b7872c1
Rewrite unexpected-osascript-calls for simplicity 2023-01-06 15:31:08 -05:00
Thomas Strömberg
84711209a9
Merge pull request #109 from tstromberg/shell-parent-events
Fix more false positives, particularly in newer queries
2023-01-06 10:37:37 -05:00
Thomas Stromberg
05a39a78d3
Flush out more false positives across the stack 2023-01-06 10:36:48 -05:00
Thomas Stromberg
7455c22e3c
Fix missing / 2023-01-06 10:19:33 -05:00
Thomas Stromberg
9843def319
Fix more false positives, particularly in shell/fetcher parents 2023-01-06 10:18:19 -05:00
Thomas Strömberg
3db3559a7f
Merge pull request #108 from tstromberg/shell-parent-events
new detectors: unexpected shell & fetcher events
2023-01-04 15:49:36 -05:00
Thomas Stromberg
02881f7a0c
Remove empty line 2023-01-04 15:49:21 -05:00
Thomas Stromberg
9c512c5fd7
new detector: unexpected fetcher parents 2023-01-04 15:48:13 -05:00
Thomas Stromberg
1dbd98c57e
Add enough exceptions to make this useful 2023-01-04 11:58:54 -05:00
Thomas Stromberg
0ad0b3be8c
detection/initial_access/unexpected-shell-parent-events.sql
new detector: unexpected shell parent events
2023-01-04 11:43:26 -05:00
Thomas Strömberg
88e0e5fb57
Merge pull request #107 from tstromberg/root-signers
new detector: unexpected root process signer on macOS
2023-01-04 11:20:27 -05:00
Thomas Stromberg
64ed2bba02
new detector: software running as root on macOS with an unexpected authority 2023-01-04 11:19:44 -05:00
Thomas Strömberg
6f160c686d
Merge pull request #106 from tstromberg/relative-exec
New detector: relative exec low uid
2023-01-04 11:15:09 -05:00
Thomas Stromberg
ef3653216e
New detector: relative exec low uid 2023-01-04 11:14:04 -05:00
Thomas Strömberg
8c35d9c14a
Merge pull request #105 from tstromberg/bmw-of-greensboro
Catch up to other winter-break false positives
2023-01-04 11:09:59 -05:00
Thomas Stromberg
5735d87453
Add execdir exception for ~/%packages 2023-01-04 11:09:20 -05:00
Thomas Stromberg
71cda72dc1
Add exception for dmesg reading /dev/kmsg 2023-01-04 11:08:05 -05:00
Thomas Stromberg
aa7d9d21f7
Fix firefox typo 2023-01-04 11:05:03 -05:00
Thomas Stromberg
ba23df1fef
Catch up to other false positives over winter break 2023-01-04 11:03:38 -05:00
Thomas Strömberg
12acae7250
Merge pull request #104 from tstromberg/new-years
New Years FP cleanup: monitorix, snap-confine, steam, spotify, etc
2023-01-03 08:50:59 -05:00
Thomas Stromberg
a8b95a2c9e
New Years cleanup: monitorix, snap-confine, steam, spotify, etc 2023-01-03 08:50:19 -05:00
Thomas Strömberg
fd2b240344
Merge pull request #103 from tstromberg/sketchy-fetcher-refactor
sketchy fetchers: Remove trailing commas
2022-12-20 08:03:54 -05:00
Thomas Stromberg
44ca59c9d6
sketchy fetchers: Remove trailing commas 2022-12-20 08:03:14 -05:00
Thomas Strömberg
a6a8c28448
Merge pull request #102 from tstromberg/sketchy-fetcher-refactor
sketchy fetcher: Add grandparents and TLD detector
2022-12-20 07:54:17 -05:00
Thomas Strömberg
45cbb3e731
Merge pull request #101 from tstromberg/parent-missing
parent-missing-from-disk: Filter out Docker children too
2022-12-20 07:54:10 -05:00