valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 09:58:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
3,122 Commits 2 Branches 109 Tags 25 MiB
e969b92a2e
Commit Graph

23 Commits

Author SHA1 Message Date
Chris Long
05bab35611 Adding detection query for Java_Adwind Trojan (#2284) 2016-08-03 10:46:14 -07:00
Michael George
f0108ac901 update osx_attacks with Backdoor.MAC.Eleanor with fixes (#2226) 2016-07-07 15:14:27 -07:00
Javier Marcos
43dd75eb59 Adding folder signature for iWorm OSX malware (#2231) 2016-07-07 15:14:01 -07:00
Chris Long
1e9aa1a49c Adding Aobo Keylogger and OSX_Keydnap to osx-attacks (#2230) 2016-07-07 14:04:05 -07:00
Javier Marcos
152602dfdd Adding sip_config table to it-compliance pack (#2131) 2016-06-02 12:22:59 -07:00
Chris Long
9ccbd08330 Adding Elite Keylogger Detection to osx-attacks (#2031) 2016-04-09 13:54:15 -07:00
Serey Ty
198c8ff978 Add detection for OSX Pirrit (#2029) 
See: https://threatpost.com/mac-adware-osx-pirrit-unleashes-ad-overload-for-now/117273/

Someone also wrote a removal for it:
https://github.com/aserper/osx.pirrit_removal/blob/master/remove_pirrit.sh
 2016-04-08 11:29:44 -07:00
Chris Long
de1c630850 Adding wildcards 2016-03-27 00:10:27 -05:00
Chris Long
c9e4f8038d Adding detection for new adware variants to osx-attacks 2016-03-26 10:47:44 -05:00
Javier Marcos
7c18ce9bb0 OSX Keranger detection fix 2016-03-07 09:25:32 -08:00
Javier Marcos
bdd783366d Adding detectiong for OSX Keranger 2016-03-06 16:40:03 -08:00
Sereyvathana Ty
7b772880b7 Added new detection for hacking team 
Detect persistency binary from hacking team (ref: https://reverse.put.as/2016/02/29/the-italian-morons-are-back-what-are-they-up-to-this-time/)
 2016-02-29 23:28:18 -08:00
Teddy Reed
9a54af29ce Bump sqlite to 3.11.0 2016-02-21 22:40:37 -08:00
Teddy Reed
581e2213de Add unauthenticated sparkle feeds query to vuln-mgmt pack 2016-02-01 12:51:36 -08:00
Richard Pickman
2fbe6a48b0 Update osx-attacks.conf 
Make Genieo query use 'like' instead of '='
 2015-12-10 16:01:31 -08:00
Teddy Reed
b7650e5291 Remove passwd_changes and user_data from event callbacks 2015-12-07 17:47:38 -08:00
Teddy Reed
44286eb611 Add hardware/internal (monitoring) packs and reduce FPs, duplicate queries 2015-11-26 16:00:53 -08:00
Sharvil Shah
0604a3dd08 Update wireless_networks in IR pack to use wifi_networks table 2015-11-22 00:44:06 -08:00
Michael George
bd31320cb5 adding genieo query 2015-11-21 14:32:07 -08:00
Mike Arpaia
bad6481375 Update an error in the incident response pack 
#1398
 2015-07-27 11:38:51 -07:00
Teddy Reed
5cd9adae15 [Fix ##1385] Remove com.yourcompany from packs due to high FPs 2015-07-24 01:48:47 -07:00
Teddy Reed
7c330f0bf8 [Fix #1369] Limit IOKit HID events 2015-07-23 11:52:23 -07:00
Javier Marcos
36e550db0b Query packs files 2015-07-17 14:42:05 -07:00