fpr: and rule consolidation

detection/c2/unexpected-dns-traffic.sql

@@ -100,8 +100,9 @@ WHERE
     '/usr/lib/systemd/systemd-resolved',
     '/usr/sbin/mDNSResponder'
   )
-  AND p.path NOT LIKE '/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/%/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'
   AND p.path NOT LIKE '%/podman/gvproxy'
+  AND p.path NOT LIKE '%/Steam/Steam.AppBundle/Steam/Contents/MacOS/Frameworks/Steam Helper.app/Contents/MacOS/Steam Helper'
+  AND p.path NOT LIKE '/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/%/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper'
   -- Workaround for the GROUP_CONCAT subselect adding a blank ent
   -- Workaround for the GROUP_CONCAT subselect adding a blank ent
 GROUP BY

detection/c2/unexpected-talkers-linux.sql

@@ -323,5 +323,8 @@ WHERE
       OR p.cgroup_path LIKE '/user.slice/user-%.slice/user@%.service/user.slice/nerdctl-%'
     )
   )
+  AND NOT parent_cmd IN (
+    '/opt/microsoft/msedge/msedge'
+  )
 GROUP BY
   p.cmdline

detection/evasion/hidden-cwd.sql

@@ -163,6 +163,7 @@ WHERE
       '~/dev/extra-packages/.chainguard'
     )
     OR top_dir IN (
+      '/var~/.config',
       '/var~/.local',
       '~/dev',
       '~/src',

detection/evasion/unexpected-etc-executables.sql

@@ -197,6 +197,7 @@ WHERE
     '/etc/udev/powersave.sh',
     '/etc/vpl/vars.sh'
   )
+  AND file.directory LIKE '/etc/asciidoc/%'
   -- Nix (on macOS) -- actually a symbolic link
   AND file.path NOT LIKE '/etc/etckeeper/%'
   AND file.path NOT LIKE '/etc/profiles/per-user/%/bin/%'

detection/persistence/unexpected-listening-port-linux.sql

@@ -132,24 +132,10 @@ WHERE
     '5001,6,0,registry',
     '5005,6,500,rootlesskit',
     '5050,6,500,rootlesskit',
-    '53,17,0,coredns',
-    '53,17,114,dnsmasq',
-    '53,17,123,dnsmasq',
-    '53,17,130,dnsmasq',
-    '53,17,500,aardvark-dns',
-    '53,17,500,coredns',
-    '53,17,500,dnsmasq',
-    '53,6,0,coredns',
-    '53,6,114,dnsmasq',
-    '53,6,123,dnsmasq',
-    '53,6,130,dnsmasq',
-    '53,6,500,coredns',
-    '53,6,500,dnsmasq',
     '5355,6,193,systemd-resolve',
     '5355,6,500,systemd-resolve',
     '5432,6,70,postgres',
     '546,17,500,dhcpcd',
-    '547,17,500,dnsmasq',
     '5556,6,500,dex',
     '5556,6,500,openshot-qt',
     '5558,6,500,dex',
@@ -171,10 +157,6 @@ WHERE
     '6443,6,0,k3s-server',
     '6443,6,0,kube-apiserver',
     '6443,6,500,kube-apiserver',
-    '67,17,114,dnsmasq',
-    '67,17,123,dnsmasq',
-    '67,17,130,dnsmasq',
-    '67,17,500,dnsmasq',
     '68,17,0,dhclient',
     '68,17,100,systemd-network',
     '68,17,500,dhcpcd',
@@ -230,7 +212,6 @@ WHERE
       'com.docker.back',
       'controller',
       'crane',
-      'dnsmasq',
       'docker-proxy',
       'hugo',
       'kubectl',
@@ -243,6 +224,23 @@ WHERE
     AND lp.port > 1024
     and lp.protocol = 6
   )
+  -- Exclude common/default DNS talking
+  AND NOT (
+    p.name IN (
+      'aardvark-dns',
+      'coredns',
+      'dnsmasq'
+    )
+    AND lp.port IN (
+      53,   -- DNS
+      67,   -- DHCP/BOOTP
+      547   -- DHCPv6 server
+    )
+    AND lp.protocol IN (
+      6, -- TCP
+      17 -- UDP
+    )
+  )
   -- Exclude processes running inside of Docker containers
   AND NOT p.cgroup_path LIKE '/system.slice/docker-%'
   AND NOT p.cgroup_path LIKE '/user.slice/user-%.slice/user@%.service/user.slice/nerdctl-%'

detection/persistence/unexpected-listening-port-macos.sql

@@ -304,6 +304,10 @@ WHERE
       AND lp.protocol = 6
     )
   )
+  AND NOT (
+    p.path = '/System/Library/CoreServices/UniversalControl.app/Contents/MacOS/UniversalControl'
+    AND lp.port > 5000
+  )
   AND NOT (
     (
       exception_key LIKE '80,6,500,ssh,Software Signing'

detection/persistence/unexpected-uid0-daemon-linux.sql

@@ -158,10 +158,10 @@ WHERE
     'elastic-endpoin,/opt/Elastic/Endpoint/elastic-endpoint,0,system.slice,ElasticEndpoint.service,0500',
     'elastic-endpoin,/var/opt/Elastic/Endpoint/elastic-endpoint,0,elasticendpoint,,0500',
     'execsnoop-bpfcc,/usr/bin/python3.10,0,system.slice,com.system76.Scheduler.service,0755',
-    'firewalld,/usr/bin/python__VERSION__,0,system.slice,firewalld.service,0755',
     'firewalld,/usr/bin/python3.10,0,system.slice,firewalld.service,0755',
     'firewalld,/usr/bin/python3.12,0,system.slice,firewalld.service,0755',
     'firewalld,/usr/bin/python3.13,0,system.slice,firewalld.service,0755',
+    'firewalld,/usr/bin/python__VERSION__,0,system.slice,firewalld.service,0755',
     'fish,/usr/bin/fish,0,user.slice,user-1000.slice,0755',
     'flatpak-system-,/usr/lib/flatpak-system-helper,0,system.slice,flatpak-system-helper.service,0755',
     'flatpak-system-,/usr/libexec/flatpak-system-helper,0,system.slice,flatpak-system-helper.service,0755',
@@ -173,6 +173,10 @@ WHERE
     'fusermount,/usr/bin/fusermount,1000,user.slice,user-1000.slice,4755',
     'fwupd,/usr/lib/fwupd/fwupd,0,system.slice,fwupd.service,0755',
     'fwupd,/usr/libexec/fwupd/fwupd,0,system.slice,fwupd.service,0755',
+    'gdisk,/usr/sbin/gdisk,0,user.slice,user-1000.slice,0755',
+    'gdm,/usr/bin/gdm,0,system.slice,gdm.service,0755',
+    'gdm,/usr/sbin/gdm,0,system.slice,display-manager.service,0755',
+    'gdm,/usr/sbin/gdm,0,system.slice,gdm.service,0755',
     'gdm-session-wor,/usr/lib/gdm-session-worker,0,user.slice,user-1000.slice,0755',
     'gdm-session-wor,/usr/lib/gdm-session-worker,0,user.slice,user-120.slice,0755',
     'gdm-session-wor,/usr/libexec/gdm-session-worker,0,user.slice,user-1000.slice,0755',
@@ -182,9 +186,6 @@ WHERE
     'gdm-session-wor,/usr/libexec/gdm-session-worker,0,user.slice,user-42.slice,0755',
     'gdm-session-wor,/usr/libexec/gdm/gdm-session-worker,0,user.slice,user-1000.slice,0755',
     'gdm-session-wor,/usr/libexec/gdm/gdm-session-worker,0,user.slice,user-463.slice,0755',
-    'gdm,/usr/bin/gdm,0,system.slice,gdm.service,0755',
-    'gdm,/usr/sbin/gdm,0,system.slice,display-manager.service,0755',
-    'gdm,/usr/sbin/gdm,0,system.slice,gdm.service,0755',
     'gdm3,/usr/sbin/gdm3,0,system.slice,gdm.service,0755',
     'geoclue.service,Location Lookup Service,geoclue,500',
     'gnome-keyring-d,/usr/bin/gnome-keyring-daemon,0,user.slice,user-1000.slice,0755',
@@ -193,8 +194,8 @@ WHERE
     'gpg-agent,/usr/bin/gpg-agent,0,user.slice,user-1000.slice,0755',
     'group-admin-dae,/usr/libexec/group-admin-daemon,0,system.slice,group-admin-daemon.service,0755',
     'gssproxy,/usr/sbin/gssproxy,0,system.slice,gssproxy.service,0755',
-    'gvfsd-fuse,/usr/libexec/gvfsd-fuse,0,user.slice,user-1000.slice,0755',
     'gvfsd,/usr/libexec/gvfsd,0,user.slice,user-1000.slice,0755',
+    'gvfsd-fuse,/usr/libexec/gvfsd-fuse,0,user.slice,user-1000.slice,0755',
     'haproxy,/usr/sbin/haproxy,0,system.slice,haproxy.service,0755',
     'iio-sensor-prox,/usr/lib/iio-sensor-proxy,0,system.slice,iio-sensor-proxy.service,0755',
     'iio-sensor-prox,/usr/libexec/iio-sensor-proxy,0,system.slice,iio-sensor-proxy.service,0755',