fpr: regex bug fix; lots of fprs

detection/c2/unexpected-dns-traffic-events.sql

@@ -108,6 +108,7 @@ WHERE
     'msedge,8.8.8.8,53',
     'node,149.22.90.225,5353',
     'nuclei,1.0.0.1,53',
+    'ollama,104.21.75.227,53', -- registry.olama.ai (2025-01-27)
     'Pieces OS,208.67.222.222,53',
     'Pieces OS,8.8.4.4,53',
     'plugin-container,8.8.8.8,53',

detection/evasion/hidden-executable.sql

@@ -123,6 +123,7 @@ WHERE
     '~/node_modules/.bin',
     '~/thinkorswim/.install4j'
   )
+  AND NOT f.directory = '/nix/store/.links'
   AND NOT f.directory LIKE '%/.terraform/%'
   AND NOT f.directory LIKE '%/anchore/grype/.tool%'
   AND NOT f.directory LIKE '%/Applications/PSI Bridge Secure Browser.app/Contents/Resources/.apps/darwin/%'

detection/evasion/parent-missing-from-disk-linux.sql

@@ -93,7 +93,8 @@ WHERE
   AND p1.cgroup_path NOT LIKE '/system.slice/docker-%'
   AND p1.cgroup_path NOT IN (
     '/system.slice/containerd.service',
-    '/system.slice/docker.service'
+    '/system.slice/docker.service',
+    '/system.slice/gdm.service'
   )
   AND p1.cgroup_path NOT LIKE '/lxc.monitor.n%'
   AND p1.cgroup_path NOT LIKE '/user.slice/user-1000.slice/[email protected]/app.slice/app-steam@%'

detection/evasion/unexpected-hidden-system-paths.sql

@@ -88,6 +88,7 @@ WHERE
     '/lib/jvm/.java-1.17.0-openjdk-amd64.jinfo',
     '/tmp/._contentbarrier_installed',
     '/tmp/.accounts-agent/',
+    '/tmp/.aqua/',
     '/tmp/.audio-agent/',
     '/tmp/.bazelci/',
     '/tmp/.BBE72B41371180178E084EEAF106AED4F350939DB95D3516864A1CC62E7AE82F', -- Xcode
@@ -221,7 +222,8 @@ WHERE
   AND file.path NOT LIKE '/tmp/.%.gcode'
   AND file.path NOT LIKE '/tmp/.cdx.json%'
   AND file.path NOT LIKE '/tmp/.com.google.Chrome.%'
-  AND file.path NOT LIKe '/tmp/.com.microsoft.Edge.%'
+  AND file.path NOT LIKE '/tmp/.com.microsoft.Edge.%'
+  AND file.path NOT LIKE '/tmp/.com.valvesoftware.Steam.%/'
   AND file.path NOT LIKE '/tmp/.dropbox-dist-%'
   AND file.path NOT LIKE '/tmp/.io.nwjs.%'
   AND file.path NOT LIKE '/tmp/.lark_cache_%'

detection/execution/unexpected-chmod-exec-event-linux.sql

@@ -117,6 +117,10 @@ WHERE
       AND cmdline NOT LIKE 'chmod +x /home/%/bin/%'
       AND cmdline NOT LIKE '%chmod 755 /home/%/.local/share/cinnamon/applets/download-and-upload-speed@cardsurf/translation.sh'
   )
+  AND NOT (
+    f_path = '/usr/local/bin/kubectl'
+    AND f_mode = '0755'
+  )
   AND pe.time > (strftime('%s', 'now') -300)
   AND pe.syscall = "execve"
   AND f.type != 'directory'

detection/execution/unexpected-executable-permissions.sql

@@ -105,6 +105,10 @@ WHERE
     f.path LIKE '/home/%/.local/share/JetBrains/Toolbox/bin/jetbrains-toolbox'
     AND f.mode = '0744'
   )
+  AND NOT (
+    f.path LIKE '/home/%/.cache/JetBrains/%/semantic-search/server/%/embeddings-server'
+    AND f.mode = '0764'
+  )
   AND NOT (
     f.path LIKE '/Users/%/Applications (Parallels)/%.app/Contents/MacOS/WinAppHelper'
     AND f.mode = '0777'

detection/initial_access/unexpected-diskimage-source-macos.sql

@@ -19,7 +19,7 @@ SELECT
   signature.identifier,
   signature.authority,
   ea.value AS url,
-  REGEX_MATCH (ea.value, '/[\w_-]+\.([\w\._-]+)[:/]', 1) AS domain,
+  REGEX_MATCH (ea.value, '/([\w-]+\.[\w-]+)(?=[:/]|$)', 1) AS domain,
   REGEX_MATCH (ea.value, '/([\w_-]+\.[\w\._-]+)[:/]', 1) AS host
 FROM
   mdfind
@@ -95,6 +95,7 @@ WHERE
     'google.ca',
     'google.com',
     'grammarly.com',
+    'granola.ai',
     'imazing.com',
     'integodownload.com',
     'irccloud.com',
@@ -130,6 +131,7 @@ WHERE
     'overwolf.com',
     'pathofexile.com',
     'perforce.com',
+    'plugable.com',
     'poecdn.com',
     'pqrs.org',
     'proxmox.com',
@@ -228,6 +230,7 @@ WHERE
     'openai.com',
     'packages.openvpn.net',
     'persistent.oaistatic.com',
+    'plugable.com',
     'portswigger-cdn.net',
     'posit.co',
     'prerelease.keybase.io',
@@ -258,6 +261,7 @@ WHERE
     'wavebox.io',
     'welcome.adguard.com',
     'www.google.com',
+    'www.granola.ai',
     'www.messenger.com',
     'www.raycast.com',
     'www.talos.dev',

detection/persistence/listening-from-unusual-location.sql

@@ -87,6 +87,7 @@ WHERE
       'node',
       'nuclei',
       'ollama',
+      'ping',
       'qemu-system-aarch64',
       'qemu-system-x86',
       'rootlessport',

detection/persistence/unexpected-listening-port-macos.sql

@@ -248,6 +248,11 @@ WHERE
     signature.authority = 'Developer ID Application: Microsoft Corporation (UBF8T346G9)'
     AND lp.port > 5000
   )
+  AND NOT (
+    signature.authority = 'Developer ID Application: OpenAI, L.L.C. (2DC432GLL2)'
+    AND lp.port > 5000
+    AND lp.protocol = 6
+  )
   AND NOT (
     exception_key LIKE '%,6,500,IPNExtension,Apple Mac OS Application Signing'
     AND lp.port > 5000

detection/privesc/unexpected-privilege-escalation_linux.sql

@@ -83,7 +83,10 @@ WHERE
   )
   AND NOT (
     p0.name = 'fusermount3'
-    AND p1.path = '/usr/lib/xdg-document-portal'
+    AND p1.path IN (
+      '/usr/lib/xdg-document-portal',
+      '/usr/libexec/xdg-document-portal'
+    )
   )
   AND NOT (
     p0.path = '/usr/bin/pkexec'