-- Find programs running from strange directories on macOS -- -- false positives: -- - Vendors who are doing weird things that are not in the signature list -- -- See "execdir-events" for the version that is more likely to catch things -- -- platform: darwin -- tags: transient seldom process filesystem state SELECT DISTINCT REGEX_MATCH (p0.path, '(.*)/', 1) AS dir, REPLACE(f.directory, u.directory, '~') AS homedir, REGEX_MATCH ( REPLACE(f.directory, u.directory, '~'), '(~/.*?/.*?/.*?/)', 1 ) AS top3_homedir, REGEX_MATCH ( REPLACE(f.directory, u.directory, '~'), '(~/.*?/)', 1 ) AS top_homedir, s.authority AS p0_auth, s.identifier AS p0_id, -- Child p0.pid AS p0_pid, p0.path AS p0_path, p0.name AS p0_name, p0.cmdline AS p0_cmd, p0.cwd AS p0_cwd, p0.euid AS p0_euid, p0_hash.sha256 AS p0_sha256, -- Parent p0.parent AS p1_pid, p1.path AS p1_path, p1.name AS p1_name, p1_f.mode AS p1_mode, p1.euid AS p1_euid, p1.cmdline AS p1_cmd, p1_hash.sha256 AS p1_sha256, -- Grandparent p1.parent AS p2_pid, p2.name AS p2_name, p2.path AS p2_path, p2.cmdline AS p2_cmd, p2_hash.sha256 AS p2_sha256 FROM processes p0 LEFT JOIN file f ON p0.path = f.path LEFT JOIN users u ON p0.uid = u.uid LEFT JOIN signature s ON p0.path = s.path LEFT JOIN hash p0_hash ON p0.path = p0_hash.path LEFT JOIN processes p1 ON p0.parent = p1.pid LEFT JOIN file p1_f ON p1.path = p1_f.path LEFT JOIN hash p1_hash ON p1.path = p1_hash.path LEFT JOIN processes p2 ON p1.parent = p2.pid LEFT JOIN hash p2_hash ON p2.path = p2_hash.path WHERE p0.pid IN ( SELECT pid FROM processes WHERE pid > 0 AND REGEX_MATCH ( path, "^(/System|/usr/libexec/|/usr/sbin/|/usr/bin/|/usr/lib/|/bin/|/Applications|/Library/Apple/|/sbin/|/usr/local/kolide-k2)", 1 ) IS NULL GROUP BY path ) AND dir NOT IN ( '/Library/Application Support/Logitech.localized/Logitech Options.localized/LogiMgrUpdater.app/Contents/Resources', '/Library/DropboxHelperTools/Dropbox_u501', '/Library/Filesystems/kbfuse.fs/Contents/Resources', '/Library/Frameworks/Python.framework/Versions/3.10/bin', '/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers.app/Contents/MacOS', '/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/Contents/MacOS', '/Library/Printers/DYMO/Utilities', '/Library/Kandji/Kandji Agent.app/Contents/MacOS/', '/Library/Application Support/Kandji/Kandji Menu/Kandji Menu.app/Contents/MacOS', '/Library/PrivilegedHelperTools', '/Library/TeX/texbin', '/usr/local/aws-cli', '/nix/store', '/nix/var/nix/profiles/default/bin', '/opt/homebrew/Caskroom/google-cloud-sdk/latest/google-cloud-sdk/bin/gke-gcloud-auth-plugin', '/opt/usr/bin', '/opt/X11/bin', '/opt/X11/libexec', '/run/current-system/sw/bin' ) AND homedir NOT IN ( '~/bin', '~/code/bin', '~/Downloads/google-cloud-sdk/bin', '~/Library/Application Support/minecraft/launcher/launcher.bundle/Contents/Frameworks/launcher-Helper (Renderer).app/Contents/MacOS', '~/go/bin', '~/Library/Application Support/sourcegraph-sp/', '~/Library/Application Support/cloud-code/installer/google-cloud-sdk/bin', '~/Library/Application Support/dev.warp.Warp-Stable', '~/Library/Application Support/zoom.us/Plugins/aomhost.app/Contents/MacOS', '~/.local/share/gh/extensions/gh-sbom', '~/.local/bin', '~/.magefile', '~/projects/go/bin' ) AND top_homedir NOT IN ( '~/Applications/', '~/Applications (Parallels)/', '~/bin/', '~/.cargo/', '~/code/', '~/Code/', '~/.steampipe/', '~/.config/', '~/dev/', '~/git/', '~/go/', '~/google-cloud-sdk/', '~/homebrew/', '~/.kuberlr/', -- '~/Library/', -- '~/.local/', '~/Parallels/', '~/proj/', '~/projects/', '~/.provisio/', '~/.pulumi/', '~/.pyenv/', '~/.rbenv/', '~/.rustup/', '~/sigstore/', '~/src/', '~/.tflint.d/', '~/.vscode/', '~/.vs-kubernetes/' ) AND top3_homedir NOT IN ( '~/Library/Application Support/BraveSoftware/', '~/Library/Application Support/com.elgato.StreamDeck/', '~/Library/Application Support/duckly/', '/Library/Application Support/EcammLive', '~/Library/Application Support/Foxit Software/', '~/Library/Application Support/JetBrains/', '~/Library/Caches/JetBrains/', '~/Library/Application Support/OpenLens', '~/Library/Application Support/sourcegraph-sp/', '~/Library/Application Support/Zwift/', '~/Library/Caches/com.mimestream.Mimestream/', '~/Library/Caches/com.sempliva.Tiles/', '~/Library/Caches/org.gpgtools.updater/', '~/Library/Caches/snyk/', '/Library/Developer/Xcode/', '~/.terraform.d/plugin-cache/registry.terraform.io/' ) AND dir NOT LIKE '/Applications/%' AND dir NOT LIKE '/private/tmp/%.app/Contents/MacOS' AND dir NOT LIKE '/private/tmp/go-build%/exe' AND dir NOT LIKE '/private/tmp/KSInstallAction.%/Install Google Software Update.app/Contents/Helpers' AND dir NOT LIKE '/private/tmp/nix-build-%' AND dir NOT LIKE '/private/tmp/PKInstallSandbox.%/Scripts/com.microsoft.OneDrive.%' AND dir NOT LIKE '/private/var/db/com.apple.xpc.roleaccountd.staging/%.xpc/Contents/MacOS' AND dir NOT LIKE '/private/var/folders/%/bin' AND dir NOT LIKE '/private/var/folders/%/Contents/%' AND dir NOT LIKE '/private/var/folders/%/d/Wrapper/%.app' AND dir NOT LIKE '/private/var/folders/%/go-build%' AND dir NOT LIKE '/private/var/folders/%/GoLand' AND dir NOT LIKE '%/.terraform/providers/%' AND dir NOT LIKE '/Volumes/com.getdropbox.dropbox-%' AND homedir NOT LIKE '~/%/google-cloud-sdk/bin/%' AND homedir NOT LIKE '~/Library/Caches/ms-playwright/%' AND homedir NOT LIKE '~/%/node_modules/.pnpm/%' AND homedir NOT LIKE '~/%/node_modules/.bin/%' AND homedir NOT LIKE '~/.local/%/packages/%' AND homedir NOT LIKE '~/Library/Printers/%/Contents/MacOS' AND homedir NOT LIKE '~/Library/Caches/%/org.sparkle-project.Sparkle/Launcher/%/Updater.app/Contents/MacOS' AND homedir NOT LIKE '~/Library/Application Support/cloud-code/bin/versions/%' AND s.authority NOT IN ( 'Apple iPhone OS Application Signing', 'Apple Mac OS Application Signing', 'Developer ID Application: Adobe Inc. (JQ525L2MZD)', 'Developer ID Application: Cisco (DE8Y96K9QP)', 'Developer ID Application: CodeWeavers Inc. (9C6B7X7Z8E)', 'Developer ID Application: Corsair Memory, Inc. (Y93VXCB8Q5)', 'Developer ID Application: Docker Inc (9BNSXJN65R)', 'Developer ID Application: Dropbox, Inc. (G7HH3F8CAK)', 'Developer ID Application: EnterpriseDB Corporation (26QKX55P9K)', 'Developer ID Application: Figma, Inc. (T8RA8NE3B7)', 'Developer ID Application: GEORGE NACHMAN (H7V7XYVQ7D)', 'Developer ID Application: Google LLC (EQHXZ8M8AV)', 'Developer ID Application: Hashicorp, Inc. (D38WU7D763)', 'Developer ID Application: Sublime HQ Pty Ltd (Z6D26JE4Y4)', 'Developer ID Application: Logitech Inc. (QED4VVPZWA)', 'Developer ID Application: JetBrains s.r.o. (2ZEFAR8TH3)', 'Developer ID Application: Microsoft Corporation (UBF8T346G9)', 'Developer ID Application: Node.js Foundation (HX7739G8FX)', 'Developer ID Application: Objective Development Software GmbH (MLZF7K7B5R)', 'Developer ID Application: Objective-See, LLC (VBG97UB4TA)', 'Developer ID Application: Opal Camera Inc (97Z3HJWCRT)', 'Developer ID Application: Oracle America, Inc. (VB5E2TV963)', 'Developer ID Application: TablePlus Inc (3X57WP8E8V)', 'Developer ID Application: Tenable, Inc. (4B8J598M7U)', 'Developer ID Application: Valve Corporation (MXGJJ98X76)', 'Developer ID Application: Wireshark Foundation, Inc. (7Z6EMTD2C6)', 'Software Signing' ) -- Locally built executables AND NOT ( s.identifier = "a.out" AND homedir LIKE '~/%' AND p1.name LIKE '%sh' )