osquery-defense-kit/detection/evasion
Thomas Stromberg ecc8a89ed4
Add 'garmin_gps' kernel module
2022-10-29 14:13:16 -04:00
..
empty_environ_linux.sql empty environ: add exception for bwrap 2022-10-29 11:53:05 -04:00
empty_environ_macos.sql Final KubeCon 2022 false-positive cleanup 2022-10-28 19:24:00 -04:00
executables-from-the-future.sql Add a lot more mitre data 2022-10-19 16:56:32 -04:00
hidden-cwd.sql Final KubeCon 2022 false-positive cleanup 2022-10-28 19:24:00 -04:00
hidden-launchd-files-macos.sql Add a lot more mitre data 2022-10-19 16:56:32 -04:00
hidden-parent-pid.sql Add a lot more mitre data 2022-10-19 16:56:32 -04:00
missing-from-disk-linux.sql Add a lot more mitre data 2022-10-19 16:56:32 -04:00
missing-from-disk-macos.sql Final KubeCon 2022 false-positive cleanup 2022-10-28 19:24:00 -04:00
name_path_mismatch.sql Add a lot more mitre data 2022-10-19 16:56:32 -04:00
old-binaries-running.sql Add a lot more mitre data 2022-10-19 16:56:32 -04:00
parent-missing-from-disk.sql detection: Reduce Linux desktop false positives 2022-10-25 11:39:51 -04:00
ssh-notty.sql Add a lot more mitre data 2022-10-19 16:56:32 -04:00
touched-executable-linux.sql Final KubeCon 2022 false-positive cleanup 2022-10-28 19:24:00 -04:00
touched-executable-macos.sql Add Cloud SDK exception 2022-10-29 11:44:29 -04:00
unexpected-alf-exceptions-macos.sql Split up the unexpected-filesystem-entries by platform 2022-10-14 15:14:24 -04:00
unexpected-dev-entries.sql Don't mask directories, run on macOS 2022-10-20 07:59:06 -04:00
unexpected-dev-executables-linux.sql Remove more in-the-wild false positives 2022-10-27 16:55:00 -04:00
unexpected-etc-executables.sql add exceptions for nix, kde paths, rvictl, and profile 2022-10-21 11:37:55 -04:00
unexpected-hidden-system-folders.sql Finish out the incident_response refactor 2022-10-19 16:19:53 -04:00
unexpected-kernel-extensions-macos.sql Add support for interval tags 2022-10-14 14:19:13 -04:00
unexpected-kernel-modules-linux.sql Add 'garmin_gps' kernel module 2022-10-29 14:13:16 -04:00
unexpected-ld-so-files-linux.sql Add more false positive filters 2022-10-17 19:01:16 -04:00
unexpected-library-entries-macos.sql Merge pull request #9 from chainguard-dev/false-positives 2022-10-20 13:39:15 -04:00
unexpected-tmp-executables.sql Allow larger shell/python programs 2022-10-21 11:41:33 -04:00
unexpected-var-executables-linux.sql Split up the unexpected-filesystem-entries by platform 2022-10-14 15:14:24 -04:00
unexpected-var-executables-macos.sql Final KubeCon 2022 false-positive cleanup 2022-10-28 19:24:00 -04:00