fpr: mal, docker, warp, chromium, bose, mozilla

detection/c2/1-unexpected-https-linux.sql

@@ -79,8 +79,8 @@ WHERE
     '0,elastic-agent,u,g,elastic-agent',
     '0,elastic-endpoint,0u,0g,elastic-endpoin',
     '0,filebeat,0u,0g,filebeat',
-    '0,flatpak-system-helper,0u,0g,flatpak-system-',
     '0,flatpak,0u,0g,flatpak',
+    '0,flatpak-system-helper,0u,0g,flatpak-system-',
     '0,git-remote-http,0u,0g,git-remote-http',
     '0,go,0u,0g,go',
     '0,gtk4-update-icon-cache,0u,0g,gtk-update-icon',
@@ -94,8 +94,8 @@ WHERE
     '0,melange,500u,500g,melange',
     '0,metricbeat,0u,0g,metricbeat',
     '0,nessusd,0u,0g,nessusd',
-    '0,nix,0u,0g,nix-daemon',
     '0,nix,0u,0g,nix',
+    '0,nix,0u,0g,nix-daemon',
     '0,orbit,0u,0g,orbit',
     '0,osqueryd,0u,0g,osqueryd',
     '0,packagekitd,0u,0g,packagekitd',
@@ -117,8 +117,8 @@ WHERE
     '128,fwupdmgr,0u,0g,fwupdmgr',
     '129,fwupdmgr,0u,0g,fwupdmgr',
     '42,http,0u,0g,https',
-    '500,___go_build_main_go,500u,500g,___go_build_mai',
     '500,1password,0u,0g,1password',
+    '500,___go_build_main_go,500u,500g,___go_build_mai',
     '500,abrt-action-generate-core-backtrace,0u,0g,abrt-action-gen',
     '500,accountwizard,u,g,accountwizard',
     '500,act,0u,0g,act',
@@ -132,10 +132,11 @@ WHERE
     '500,bash,0u,0g,bash',
     '500,beeper,u,g,beeper',
     '500,bitwarden,u,g,bitwarden',
-    '500,bom-linux-amd64,500u,500g,bom-linux-amd64',
     '500,bom,500u,500g,bom',
+    '500,bom-linux-amd64,500u,500g,bom-linux-amd64',
     '500,Brackets,0u,0g,Brackets',
     '500,brave,0u,0g,brave',
+    '500,brave,u,g,brave',
     '500,buildkitd,500u,500g,buildkitd',
     '500,buildkite-agent,500u,500g,buildkite-agent',
     '500,cargo,0u,0g,cargo',
@@ -146,34 +147,36 @@ WHERE
     '500,chainctl,500u,493g,chainctl',
     '500,chainctl,500u,500g,chainctl',
     '500,chainctl,500u,500g,docker-credenti',
-    '500,chrome_crashpad_handler,0u,0g,chrome_crashpad',
     '500,chrome,0u,0g,chrome',
     '500,chrome,u,g,chrome',
+    '500,chrome_crashpad_handler,0u,0g,chrome_crashpad',
+    '500,chromium,0u,0g,chromium',
     '500,cilium,500u,123g,cilium',
     '500,cloud_sql_proxy,0u,0g,cloud_sql_proxy',
     '500,cockatrice,u,g,cockatrice',
-    '500,code-oss,u,g,code-oss',
+    '500,codium,0u,0g,codium',
     '500,code,0u,0g,code',
     '500,code,500u,500g,code',
     '500,code,u,g,code',
+    '500,code-oss,u,g,code-oss',
     '500,com.docker.backend,0u,0g,com.docker.back',
     '500,com.docker.build,0u,0g,com.docker.buil',
     '500,com.docker.extensions,0u,0g,com.docker.exte',
     '500,containerd,u,g,containerd',
     '500,copilot-agent-linux,500u,500g,copilot-agent-l',
     '500,copilot-language-server,500u,500g,copilot-languag',
     '500,copy-from-gs,500u,500g,copy-from-gs',
-    '500,cosign-linux-amd64,0u,0g,cosign',
     '500,cosign,500u,500g,cosign',
+    '500,cosign-linux-amd64,0u,0g,cosign',
     '500,crane,0u,0g,crane',
     '500,crane,500u,500g,crane',
     '500,curl,0u,0g,curl',
     '500,deno,500u,500g,deno',
     '500,Discord,0u,0g,Discord',
     '500,Discord,u,g,Discord',
     '500,Docker Desktop,0u,0g,Docker Desktop',
-    '500,docker-buildx,0u,0g,docker-buildx',
     '500,docker,0u,0g,docker',
+    '500,docker-buildx,0u,0g,docker-buildx',
     '500,drkonqi,0u,0g,drkonqi',
     '500,eksctl,0u,0g,eksctl',
     '500,eksctl,500u,500g,eksctl',
@@ -182,30 +185,31 @@ WHERE
     '500,evolution-calendar-factory,0u,0g,evolution-calen',
     '500,evolution-source-registry,0u,0g,evolution-sourc',
     '500,extension-manager,0u,0g,extension-manag',
-    '500,firefox-bin,500u,500g,firefox-bin',
-    '500,firefox-bin,u,g,firefox-bin',
     '500,firefox,0u,0g,.firefox-wrappe',
     '500,firefox,0u,0g,firefox',
     '500,firefox,0u,0g,Socket Process',
+    '500,firefox-bin,0u,0g,firefox-bin',
+    '500,firefox-bin,500u,500g,firefox-bin',
+    '500,firefox-bin,u,g,firefox-bin',
     '500,flameshot,0u,0g,flameshot',
-    '500,flatpak-oci-authenticator,0u,0g,flatpak-oci-aut',
     '500,flatpak,0u,0g,flatpak',
+    '500,flatpak-oci-authenticator,0u,0g,flatpak-oci-aut',
     '500,flux,500u,500g,flux',
     '500,fulcio,500u,500g,fulcio',
     '500,gcsfuse,500u,500g,gcsfuse',
     '500,gdb,0u,0g,gdb',
     '500,geoclue,0u,0g,geoclue',
-    '500,gh-dash,500u,500g,gh-dash',
     '500,gh,0u,0g,gh',
+    '500,gh-dash,500u,500g,gh-dash',
+    '500,git,0u,0g,git',
     '500,git-remote-http,0u,0g,git-remote-http',
     '500,git-remote-http,u,g,git-remote-http',
-    '500,git,0u,0g,git',
     '500,github-desktop,0u,0g,github-desktop',
-    '500,gitsign-credential-cache,500u,500g,gitsign-credent',
     '500,gitsign,0u,0g,gitsign',
     '500,gitsign,500u,0g,gitsign',
     '500,gitsign,500u,500g,gitsign',
     '500,gitsign,u,g,gitsign',
+    '500,gitsign-credential-cache,500u,500g,gitsign-credent',
     '500,gjs-console,0u,0g,org.gnome.Maps',
     '500,gnome-recipes,0u,0g,gnome-recipes',
     '500,gnome-shell,0u,0g,gnome-shell',
@@ -253,6 +257,7 @@ WHERE
     '500,limactl,500u,500g,limactl',
     '500,Logseq,u,g,Logseq',
     '500,losslesscut,500u,500g,losslesscut',
+    '500,mateweather-applet,0u,0g,mateweather-app',
     '500,mconvert,500u,500g,mconvert',
     '500,mediawriter,u,g,mediawriter',
     '500,melange,500u,500g,melange',
@@ -270,11 +275,11 @@ WHERE
     '500,node,500u,500g,npm run start',
     '500,node,u,g,node',
     '500,nuclei,500u,500g,nuclei',
+    '500,obs,0u,0g,obs',
+    '500,obs,u,g,obs',
     '500,obs-browser-page,0u,0g,obs-browser-pag',
     '500,obs-ffmpeg-mux,0u,0g,obs-ffmpeg-mux',
     '500,obs-ffmpeg-mux,u,g,obs-ffmpeg-mux',
-    '500,obs,0u,0g,obs',
-    '500,obs,u,g,obs',
     '500,obsidian,0u,0g,obsidian',
     '500,obsidian,u,g,obsidian',
     '500,op,0u,500g,op',
@@ -324,28 +329,30 @@ WHERE
     '500,steam,500u,500g,steam',
     '500,steamwebhelper,500u,100g,steamwebhelper',
     '500,steamwebhelper,500u,500g,steamwebhelper',
-    '500,step-cli,0u,0g,step',
     '500,step,500u,500g,step',
+    '500,step-cli,0u,0g,step',
     '500,stern,500u,500g,stern',
     '500,syft,500u,500g,syft',
     '500,syncthing,0u,0g,syncthing',
     '500,syncthing,u,g,syncthing',
     '500,synergy,0u,0g,synergy',
     '500,teams,0u,0g,teams',
+    '500,telegram-desktop,0u,0g,telegram-deskto',
     '500,telegram-desktop,u,g,telegram-deskto',
-    '500,terraform-ls,500u,500g,terraform-ls',
     '500,terraform,0u,0g,terraform',
     '500,terraform,500u,500g,terraform',
-    '500,thunderbird-bin,u,g,thunderbird-bin',
+    '500,terraform-ls,500u,500g,terraform-ls',
     '500,thunderbird,0u,0g,thunderbird',
     '500,thunderbird,u,g,thunderbird',
+    '500,thunderbird-bin,u,g,thunderbird-bin',
     '500,tidal-hifi,u,g,tidal-hifi',
     '500,tilt,500u,500g,tilt',
     '500,TJPP8_Vulkan,500u,500g,TJPP8_Vulkan',
     '500,todoist,0u,0g,todoist',
     '500,trivy,0u,0g,trivy',
     '500,trivy,500u,500g,trivy',
     '500,ubuntu-report,0u,0g,ubuntu-report',
+    '500,warp,0u,0g,warp-terminal',
     '500,WebKitNetworkProcess,0u,0g,WebKitNetworkPr',
     '500,wget,0u,0g,wget',
     '500,wine64-preloader,500u,500g,DaveTheDiver.ex',

detection/collection/1-high-disk-bytes-written.sql

@@ -79,16 +79,17 @@ WHERE
     '/usr/bin/qemu-system-x86_64',
     '/usr/bin/yay',
     '/usr/bin/zsh',
-    '/usr/lib/baloo_file_extractor',
     '/usr/lib/baloo_file',
+    '/usr/lib/baloo_file_extractor',
     '/usr/lib/flatpak-system-helper',
     '/usr/lib/snapd/snapd',
-    '/usr/lib/systemd/systemd-journald',
     '/usr/lib/systemd/systemd',
+    '/usr/lib/systemd/systemd-journald',
     '/usr/lib64/thunderbird/thunderbird',
     '/usr/libexec/coreduetd',
     '/usr/libexec/flatpak-system-helper',
     '/usr/libexec/logd_helper',
+    '/usr/libexec/mobileassetd',
     '/usr/libexec/packagekitd',
     '/usr/libexec/rosetta/oahd',
     '/usr/libexec/secd',
@@ -164,6 +165,7 @@ WHERE
     'launcher',
     'limactl',
     'logioptionsplus_updater',
+    'mal',
     'mediawriter',
     'melange-run',
     'melange',

detection/initial_access/2-sketchy-mounted-diskimage.sql

@@ -141,6 +141,7 @@ WHERE
       AND file.directory LIKE "/Volumes/%/Contents/MacOS"
       AND signature.authority NOT IN (
         "Developer ID Application: Bookry Ltd (4259LE8SU5)",
+        "Developer ID Application: Bose Corporation (QC9P7FKWH6)",
         "Developer ID Application: Justin Clift (C34AV33YLK)",
         "Developer ID Application: Logitech Inc. (QED4VVPZWA)",
         "Developer ID Application: Oracle America, Inc. (VB5E2TV963)",

detection/persistence/1-unexpected-listening-port-linux.sql

@@ -242,6 +242,7 @@ WHERE
   -- Exclude processes running inside of Docker containers
   AND NOT p.cgroup_path LIKE '/system.slice/docker-%'
   AND NOT p.cgroup_path LIKE '/kubepods.slice/%'
+  AND NOT p.cgroup_path LIKE '/user.slice/user-%.slice/user@%.service/user.slice/docker-%'
   AND NOT p.cgroup_path LIKE '/user.slice/user-%.slice/user@%.service/user.slice/nerdctl-%'
   AND NOT p.cgroup_path LIKE '/user.slice/user-1000.slice/[email protected]/user.slice/libpod-%'
   AND NOT p1_cmd LIKE 'bwrap --bind%'