| .. |
|
fake-apple-launchd.sql
|
Run make reformat, update max rows for incident response
|
2023-02-02 17:58:19 -05:00 |
|
listening-from-unusual-location.sql
|
fpr: kas, bitnami, redis, bincapz, kolide, docker, whatsapp
|
2024-07-12 16:55:49 -04:00 |
|
low-fd-socket.sql
|
fpr: lima, rpm-ostree, gitsign, kde, python, etc
|
2024-07-01 21:56:28 -04:00 |
|
minimal-socket-client-linux.sql
|
fpr: kas, bitnami, redis, bincapz, kolide, docker, whatsapp
|
2024-07-12 16:55:49 -04:00 |
|
minimal-socket-client-macos.sql
|
Overdue False Positive Reduction
|
2024-03-29 10:12:36 -04:00 |
|
suspicious-udev-runner-linux.sql
|
Improve targetting accuracy
|
2024-08-26 12:25:17 -04:00 |
|
unexpected-active-systemd-units.sql
|
improve boot-sysctl entry
|
2024-08-26 21:10:08 -04:00 |
|
unexpected-chrome-extensions.sql
|
fix trailing comma
|
2024-07-26 14:54:07 -04:00 |
|
unexpected-cron-entries.sql
|
fpr: lima, rpm-ostree, gitsign, kde, python, etc
|
2024-07-01 21:56:28 -04:00 |
|
unexpected-global-lock.sql
|
fpr: sddm-helper, smartd, Xorg, elastic, WebEx, BambuStudio, keepass, etc
|
2024-07-26 13:26:37 -04:00 |
|
unexpected-launchd-program-arguments.sql
|
fpr: syft, krunner, k9s, espeak, chainctl, supermaven
|
2024-08-12 13:57:35 -04:00 |
|
unexpected-launchd-program-macos.sql
|
Massive false-positive reduction, particularly for uBlue
|
2024-06-27 09:23:52 -04:00 |
|
unexpected-listening-port-linux.sql
|
fpr: syft, krunner, k9s, espeak, chainctl, supermaven
|
2024-08-12 13:57:35 -04:00 |
|
unexpected-listening-port-macos.sql
|
fpr: syft, krunner, k9s, espeak, chainctl, supermaven
|
2024-08-12 13:57:35 -04:00 |
|
unexpected-lock-opener.sql
|
fpr: lima, rpm-ostree, gitsign, kde, python, etc
|
2024-07-01 21:56:28 -04:00 |
|
unexpected-ssh-authorized-keys.sql
|
make reformat
|
2023-05-08 13:20:47 -04:00 |
|
unexpected-systemctl-calls-linux.sql
|
fpr: June 25
|
2024-06-25 20:48:09 -04:00 |
|
unexpected-uid0-daemon-linux.sql
|
fpr: sddm-helper, smartd, Xorg, elastic, WebEx, BambuStudio, keepass, etc
|
2024-07-26 13:26:37 -04:00 |
|
unexpected-uid0-daemon-macos.sql
|
Massive false-positive reduction, particularly for uBlue
|
2024-06-27 09:23:52 -04:00 |
|
yara-libtomcrypt-process.sql
|
Optimize YARA process queries by deduping paths
|
2023-11-02 09:53:26 -04:00 |
|
yara-suspicious-strings-process-linux.sql
|
Overdue False Positive Reduction
|
2024-03-29 10:12:36 -04:00 |
