| .. |
|
fake-apple-launchd.sql
|
…
|
|
|
listening-from-unusual-location.sql
|
massive fpr: Rapid7, Elastic, everything
|
2024-01-26 14:07:37 -05:00 |
|
low-fd-socket.sql
|
fpr: Velociraptor, nessus, kandji, java, SteelSeries, etc
|
2023-07-12 17:38:26 -04:00 |
|
minimal-socket-client-linux.sql
|
fpr: docker, fish, Stream Deck, rsync, lima, macOS
|
2023-09-26 15:14:38 -04:00 |
|
minimal-socket-client-macos.sql
|
Add more Elastic exceptions
|
2024-01-08 17:55:30 -05:00 |
|
unexpected-active-systemd-units.sql
|
massive fpr: Rapid7, Elastic, everything
|
2024-01-26 14:07:37 -05:00 |
|
unexpected-chrome-extensions.sql
|
massive fpr: Rapid7, Elastic, everything
|
2024-01-26 14:07:37 -05:00 |
|
unexpected-cron-entries.sql
|
fpr: snap, mutedeck, idea, Chrome exts
|
2024-01-18 17:15:37 -05:00 |
|
unexpected-device.sql
|
Add more rapid7 excludes
|
2024-01-26 14:24:11 -05:00 |
|
unexpected-global-lock.sql
|
Fix errors
|
2023-08-15 18:29:27 -04:00 |
|
unexpected-launchd-program-arguments.sql
|
massive fpr: Rapid7, Elastic, everything
|
2024-01-26 14:07:37 -05:00 |
|
unexpected-launchd-program-macos.sql
|
massive fpr: Rapid7, Elastic, everything
|
2024-01-26 14:07:37 -05:00 |
|
unexpected-listening-port-linux.sql
|
Reduce false positives on Ubuntu + Lima
|
2023-09-26 13:09:22 -04:00 |
|
unexpected-listening-port-macos.sql
|
massive fpr: Rapid7, Elastic, everything
|
2024-01-26 14:07:37 -05:00 |
|
unexpected-lock-opener.sql
|
fpr: Velociraptor, Hyprland, iio
|
2023-07-12 15:00:36 -04:00 |
|
unexpected-small-udev-entry-linux.sql
|
fpr: kind of everything
|
2023-12-15 17:10:06 -05:00 |
|
unexpected-ssh-authorized-keys.sql
|
…
|
|
|
unexpected-systemctl-calls-linux.sql
|
Add many exceptions
|
2023-08-15 18:13:06 -04:00 |
|
unexpected-uid0-daemon-linux.sql
|
address merge conflict
|
2024-01-26 14:15:53 -05:00 |
|
unexpected-uid0-daemon-macos.sql
|
massive fpr: Rapid7, Elastic, everything
|
2024-01-26 14:07:37 -05:00 |
|
yara-libtomcrypt-process.sql
|
Optimize YARA process queries by deduping paths
|
2023-11-02 09:53:26 -04:00 |
|
yara-suspicious-strings-process-linux.sql
|
fpr: snap, mutedeck, idea, Chrome exts
|
2024-01-18 17:15:37 -05:00 |
