Skip to content

Commit

Permalink
Merge pull request #449 from chainguard-dev/lorimor/DepersonalizeAlfEx
Browse files Browse the repository at this point in the history
Remove redundant line
  • Loading branch information
mattlorimor authored Jan 23, 2025
2 parents 61632e6 + 843bf17 commit b446217
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions detection/evasion/unexpected-alf-exceptions-macos.sql
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@ WHERE -- Filter out stock exceptions to decrease overhead
'/System/Library/CoreServices/UniversalControl.app/',
'/System/Library/PrivateFrameworks/Admin.framework/Versions/A/Resources/readconfig',
'/System/Library/PrivateFrameworks/EmbeddedOSInstall.framework/Versions/A/XPCServices/EmbeddedOSInstallService.xpc/',
'/System/Volumes/Preboot/Cryptexes/OS/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/',
'/usr/bin/nmblookup',
'/usr/libexec/bootpd',
'/usr/libexec/configd',
Expand All @@ -46,13 +47,11 @@ WHERE -- Filter out stock exceptions to decrease overhead
) -- Ignore files that ahve already been removed
AND file.filename NOT NULL
AND exception_key NOT IN (
',,/Users/cpanato/code/src/github.com/sigstore/docs/node_modules/.bin/hugo/hugo,501',
',a.out,/private/tmp/learning-labs-static/server,501',
',a.out,/Users/amouat/proj/learning-labs-static/server,501',
',a.out,/Users/dlorenc/.wash/downloads/nats-server,501',
',com.docker.docker,/Applications/Docker.app/,501',
',deskflow-server,/Applications/Deskflow.app/Contents/MacOS/deskflow-server,501',
'/System/Volumes/Preboot/Cryptexes/OS/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.Networking.xpc/',
'Apple Mac OS Application Signing,io.tailscale.ipn.macos.network-extension,/Applications/Tailscale.app/Contents/PlugIns/IPNExtension.appex/,0',
'Apple Mac OS Application Signing,io.tailscale.ipn.macos.network-extension,/Applications/Tailscale.localized/Tailscale.app/Contents/PlugIns/IPNExtension.appex/,0',
'Developer ID Application: Adguard Software Limited (TC3Q7MAJXF),com.adguard.mac.adguard.network-extension,/Library/SystemExtensions/AD3BCA34-237A-4135-B7A4-0F7477D9144C/com.adguard.mac.adguard.network-extension.systemextension/,0',
Expand Down

0 comments on commit b446217

Please sign in to comment.