| .. |
|
fake-apple-launchd.sql
|
Run make reformat, update max rows for incident response
|
2023-02-02 17:58:19 -05:00 |
|
low-fd-socket.sql
|
fpr: Velociraptor, nessus, kandji, java, SteelSeries, etc
|
2023-07-12 17:38:26 -04:00 |
|
minimal-socket-client-linux.sql
|
minimal socket client: speed query up
|
2023-06-08 20:44:08 -04:00 |
|
minimal-socket-client-macos.sql
|
fpr: RSA keys, tcpdump, login, crane, souregraph, etc
|
2023-09-20 09:30:46 -04:00 |
|
unexpected-active-systemd-units.sql
|
fpr: RSA keys, tcpdump, login, crane, souregraph, etc
|
2023-09-20 09:30:46 -04:00 |
|
unexpected-chrome-extensions.sql
|
fpr: RSA keys, tcpdump, login, crane, souregraph, etc
|
2023-09-20 09:30:46 -04:00 |
|
unexpected-cron-entries.sql
|
fpr: RSA keys, tcpdump, login, crane, souregraph, etc
|
2023-09-20 09:30:46 -04:00 |
|
unexpected-device.sql
|
Merge to master
|
2023-09-01 17:34:36 -04:00 |
|
unexpected-global-lock.sql
|
Fix errors
|
2023-08-15 18:29:27 -04:00 |
|
unexpected-launchd-program-arguments.sql
|
fpr: sourcegraph, nginx, factorio, fan control, emacs, nushell
|
2023-09-14 17:13:12 -04:00 |
|
unexpected-launchd-program-macos.sql
|
fpr: RSA keys, tcpdump, login, crane, souregraph, etc
|
2023-09-20 09:30:46 -04:00 |
|
unexpected-listening-port-linux.sql
|
fpr: RSA keys, tcpdump, login, crane, souregraph, etc
|
2023-09-20 09:30:46 -04:00 |
|
unexpected-listening-port-macos.sql
|
fpr: RSA keys, tcpdump, login, crane, souregraph, etc
|
2023-09-20 09:30:46 -04:00 |
|
unexpected-lock-opener.sql
|
fpr: Velociraptor, Hyprland, iio
|
2023-07-12 15:00:36 -04:00 |
|
unexpected-small-udev-entry-linux.sql
|
Remove recently common false positives
|
2023-09-01 17:09:47 -04:00 |
|
unexpected-ssh-authorized-keys.sql
|
make reformat
|
2023-05-08 13:20:47 -04:00 |
|
unexpected-systemctl-calls-linux.sql
|
Add many exceptions
|
2023-08-15 18:13:06 -04:00 |
|
unexpected-uid0-daemon-linux.sql
|
fpr: RSA keys, tcpdump, login, crane, souregraph, etc
|
2023-09-20 09:30:46 -04:00 |
|
unexpected-uid0-daemon-macos.sql
|
fpr: sourcegraph, nginx, factorio, fan control, emacs, nushell
|
2023-09-14 17:13:12 -04:00 |
|
yara-libtomcrypt-process.sql
|
YARA rules everywhere!
|
2023-09-20 17:03:21 -04:00 |
|
yara-suspicious-strings-process-linux.sql
|
split detection pack into subpacks
|
2023-09-20 17:43:39 -04:00 |
