Thomas Stromberg
|
190e8adcfd
|
Merge to master
|
2023-09-01 17:34:36 -04:00 |
|
Thomas Stromberg
|
84125c4bb1
|
Remove recently common false positives
|
2023-09-01 17:09:47 -04:00 |
|
Thomas Stromberg
|
dce2eb2af5
|
Add many exceptions
|
2023-08-15 18:13:06 -04:00 |
|
Thomas Stromberg
|
ce2f0f06cb
|
fpr; Keybase, grype, UpdateBrainService, OpenOffice, sqlproxy
|
2023-07-20 10:56:49 -04:00 |
|
Thomas Stromberg
|
cebf617c82
|
fpr: terragrunt, mdnsResponder, Spotify, Zoom, etc
|
2023-06-14 10:58:41 -04:00 |
|
Thomas Stromberg
|
c6eec0ee17
|
Query tuning after Geacon testing
|
2023-05-17 10:54:16 -04:00 |
|
Thomas Stromberg
|
26b2b9a4c7
|
fpr: LGHUB, aomshm, Wisdolia, uubyte, eclipse, etc
|
2023-05-11 11:29:55 -04:00 |
|
Thomas Stromberg
|
272711ae7a
|
fpr: node, nc, busybox, libvirt, etc
|
2023-05-05 12:44:46 -04:00 |
|
Thomas Stromberg
|
76cf1006c6
|
fpr: microbit, i3, Grammarly for Safari, wine
|
2023-05-02 17:49:53 -04:00 |
|
Thomas Stromberg
|
9c3f783491
|
fpr everything
|
2023-04-17 16:20:35 -04:00 |
|
Thomas Stromberg
|
0dc6748dff
|
fpr: LGHUB keys, go, Acrobat, code, yum, fwupdatemgr
|
2023-03-31 06:19:30 -04:00 |
|
Thomas Stromberg
|
d4dd423745
|
fpr: Grammarly, semodule, docker-compose, xdg, etc
|
2023-03-30 18:44:01 -04:00 |
|
Thomas Stromberg
|
9b0ed09c8e
|
fpr: xdg, docker, dbus, bpfilter_umh, docker, spotify, mage
|
2023-03-28 16:25:26 -04:00 |
|
Thomas Stromberg
|
fbc2b207b4
|
fpr: Signal, apko, aws, melange, dash, stern
|
2023-03-16 17:29:11 -04:00 |
|
Thomas Stromberg
|
fb7cd56249
|
fpr: abrt-dbus, gdm, chrome, ff, etc
|
2023-02-24 16:30:17 -05:00 |
|
Ian Brown
|
737eb93b48
|
Add osquery to keyboard_sniffer
Signed-off-by: Ian Brown <ian@zestysoft.com>
|
2023-02-21 22:07:08 -08:00 |
|
Thomas Stromberg
|
d3780c0a6c
|
Remove ubuntu-lts false-positives on lima
|
2023-02-20 19:10:12 -05:00 |
|
Thomas Stromberg
|
e8cf7ecbe3
|
fpr: exceptions for pacman, StreamDeck, gcloud, Rocket, thunderbird
|
2023-02-20 18:04:17 -05:00 |
|
Thomas Stromberg
|
75b7ec5552
|
macos sniffers: back out osquery change until we understand it better, sort exceptions
|
2023-02-20 11:58:43 -05:00 |
|
Ian Brown
|
d64fd44604
|
fix
Signed-off-by: Ian Brown <ian@zestysoft.com>
|
2023-02-19 19:44:31 -08:00 |
|
Ian Brown
|
96e95a7f37
|
Add additional talkers
Signed-off-by: Ian Brown <ian@zestysoft.com>
|
2023-02-19 11:11:13 -08:00 |
|
Ian Brown
|
551d7dbb8c
|
fpr: Fujitsu, vmware, objective-see, paragon, etc
Signed-off-by: Ian Brown <ian@zestysoft.com>
|
2023-02-18 12:02:40 -08:00 |
|
Thomas Stromberg
|
cf858d193d
|
fpr: ACE, Prusa, steam, pacman, Xcode, Adobe
|
2023-02-14 20:16:02 -05:00 |
|
Thomas Stromberg
|
8d4531198f
|
fpr: My ORA, Ecamm, setroubleshootd, etc
|
2023-02-14 19:46:36 -05:00 |
|
Thomas Stromberg
|
a8ed058d4d
|
Query performance improvements, add pids, decrease frequency
|
2023-02-09 17:01:29 -05:00 |
|
Thomas Strömberg
|
eef833287a
|
Merge pull request #164 from NACHOSWITHCHEESE/fixing-macos-detection-compatibility
Modified detections explicitly targeted towards macOS to not include cgroup field
|
2023-02-08 20:54:45 -05:00 |
|
Thomas Stromberg
|
72326c3b5c
|
Massive reduction of false positives across the board
|
2023-02-08 20:06:26 -05:00 |
|
echunduri
|
e44dc167e9
|
Modified detections explicilty targeted towards macOS to not include cgroup_path fields anymore
|
2023-02-09 10:57:03 +11:00 |
|
Thomas Stromberg
|
e57f03b89f
|
fpr: Opera, TextExpander, socket_vmnet, elive, etc
|
2023-02-08 15:12:10 -05:00 |
|
Thomas Stromberg
|
2634e9d45b
|
Monday morning false-positive purge
|
2023-02-08 14:37:09 -05:00 |
|
Thomas Stromberg
|
d302a9ff55
|
Purge false positives, again and again
|
2023-02-02 21:46:53 -05:00 |
|
Thomas Stromberg
|
2093a26423
|
Fix broken macOS queries
|
2023-02-02 15:33:25 -05:00 |
|
Thomas Stromberg
|
f9dce0a72d
|
Include more process information across queries
|
2023-02-01 13:55:55 -05:00 |
|
Thomas Stromberg
|
d51bd731a1
|
fpr: Parallels, nerdctl, Xorg, nvidia, Stream, etc
|
2023-01-26 20:40:47 -05:00 |
|
Thomas Stromberg
|
f5fe9a4aac
|
Refactor process_events queries for more accurate parenting
|
2023-01-26 11:40:54 -05:00 |
|
Thomas Stromberg
|
83cc38207e
|
fpr: minikube, tailscale, dex, pacman, virtualbox, steam, lsmod, busybox, etc
|
2023-01-23 20:33:52 -05:00 |
|
Thomas Stromberg
|
e6824d87e9
|
Run 'make reformat'
|
2023-01-20 09:24:24 -05:00 |
|
Thomas Stromberg
|
dc154a6199
|
FPR: Meta Pixel Helper, systemctl, pia-daemon, 1Passwd, iTerm, Brave
|
2023-01-20 09:04:00 -05:00 |
|
Thomas Stromberg
|
d415b36b57
|
FP removal: Selenium, PolKit helper, gephi, docker-credential-gcloud, firejail, etc
|
2023-01-16 12:56:39 -05:00 |
|
Thomas Stromberg
|
e3401a07c6
|
Weekend false-positive flush
|
2023-01-14 08:19:26 -05:00 |
|
Thomas Stromberg
|
1b79359b68
|
Friday False Positive Flush
|
2023-01-13 14:10:43 -05:00 |
|
Thomas Stromberg
|
e8af31a348
|
false positives: dots, ipn, apport-gtk, homebrew, hyperkey, contexts
|
2023-01-09 09:34:20 -05:00 |
|
Thomas Stromberg
|
71cda72dc1
|
Add exception for dmesg reading /dev/kmsg
|
2023-01-04 11:08:05 -05:00 |
|
Thomas Stromberg
|
aa7d9d21f7
|
Fix firefox typo
|
2023-01-04 11:05:03 -05:00 |
|
Thomas Stromberg
|
ba23df1fef
|
Catch up to other false positives over winter break
|
2023-01-04 11:03:38 -05:00 |
|
Thomas Strömberg
|
12acae7250
|
Merge pull request #104 from tstromberg/new-years
New Years FP cleanup: monitorix, snap-confine, steam, spotify, etc
|
2023-01-03 08:50:59 -05:00 |
|
Thomas Stromberg
|
a8b95a2c9e
|
New Years cleanup: monitorix, snap-confine, steam, spotify, etc
|
2023-01-03 08:50:19 -05:00 |
|
Thomas Stromberg
|
350b0d8970
|
Add k3s /dev/kmsg exception, add parent info
|
2022-12-20 07:51:29 -05:00 |
|
Thomas Stromberg
|
15d3251120
|
False-positive flush: mount.ntfs, docker-credential-desktop, exotic socket refactor
|
2022-12-19 18:06:06 -05:00 |
|
Thomas Stromberg
|
49a19a6fd5
|
Sort out more false positives
|
2022-12-16 17:37:32 -05:00 |
|