| .. |
|
fake-apple-launchd.sql
|
Run make reformat, update max rows for incident response
|
2023-02-02 17:58:19 -05:00 |
|
listening-from-unusual-location.sql
|
fpr: mc, colima, webfilterproxyd, headlamp, record it, etc
|
2024-11-13 16:34:12 -05:00 |
|
low-fd-socket.sql
|
fpr + Mark touched-executable as extra on macOS
|
2024-10-24 11:20:06 -04:00 |
|
minimal-socket-client-linux.sql
|
fpr: mumbel, gvproxy, chainlink, telegram, systemd, etc
|
2024-11-18 16:16:52 -05:00 |
|
minimal-socket-client-macos.sql
|
fpr, refactor minimal-socket-client-macos
|
2024-10-24 15:12:33 -04:00 |
|
suspicious-systemd-unit.sql
|
suspicious systemd: accept any char instead of single quote
|
2024-11-19 16:09:38 -05:00 |
|
suspicious-udev-runner-linux.sql
|
fpr: cups, zed, pycharm, msedge, surfshark, ubiquiti
|
2024-09-24 15:10:21 -04:00 |
|
unexpected-active-systemd-units.sql
|
fpr: mumbel, gvproxy, chainlink, telegram, systemd, etc
|
2024-11-18 16:16:52 -05:00 |
|
unexpected-chrome-extensions.sql
|
fpr: mumbel, gvproxy, chainlink, telegram, systemd, etc
|
2024-11-18 16:16:52 -05:00 |
|
unexpected-cron-entries.sql
|
fpr: mumbel, gvproxy, chainlink, telegram, systemd, etc
|
2024-11-18 16:16:52 -05:00 |
|
unexpected-device-linux.sql
|
fpr: mumbel, gvproxy, chainlink, telegram, systemd, etc
|
2024-11-18 16:16:52 -05:00 |
|
unexpected-global-lock.sql
|
fpr: wider talkers exception, chrome extensions, postgres
|
2024-10-23 17:28:37 -04:00 |
|
unexpected-launchd-program-arguments.sql
|
fpr: mc, colima, webfilterproxyd, headlamp, record it, etc
|
2024-11-13 16:34:12 -05:00 |
|
unexpected-launchd-program-macos.sql
|
False-positives be damned
|
2024-08-27 18:40:43 -04:00 |
|
unexpected-listening-port-linux.sql
|
fpr: mc, colima, webfilterproxyd, headlamp, record it, etc
|
2024-11-13 16:34:12 -05:00 |
|
unexpected-listening-port-macos.sql
|
fpr: mumbel, gvproxy, chainlink, telegram, systemd, etc
|
2024-11-18 16:16:52 -05:00 |
|
unexpected-lock-opener.sql
|
fpr: lima, rpm-ostree, gitsign, kde, python, etc
|
2024-07-01 21:56:28 -04:00 |
|
unexpected-ssh-authorized-keys.sql
|
make reformat
|
2023-05-08 13:20:47 -04:00 |
|
unexpected-systemctl-calls-linux.sql
|
fpr: sequoia, osquery, cups, atops, transmission, etc
|
2024-09-23 11:07:53 -04:00 |
|
unexpected-uid0-daemon-linux.sql
|
fpr: mark exotic queries as extra, add flatpak/pop-os uid0 procs
|
2024-11-19 15:49:30 -05:00 |
|
unexpected-uid0-daemon-macos.sql
|
fpr: mc, colima, webfilterproxyd, headlamp, record it, etc
|
2024-11-13 16:34:12 -05:00 |
|
yara-libtomcrypt-process.sql
|
Optimize YARA process queries by deduping paths
|
2023-11-02 09:53:26 -04:00 |
|
yara-suspicious-strings-process-linux.sql
|
fpr: mumbel, gvproxy, chainlink, telegram, systemd, etc
|
2024-11-18 16:16:52 -05:00 |
