Reduce false positives on Ubuntu + Lima

detection/credentials/unexpected-dev-opener-linux.sql

@@ -172,6 +172,7 @@ WHERE
     '/dev/fb,Xorg',
     '/dev/hidraw,chrome',
     '/dev/hwrng,rngd',
+    '/dev/hvc,agetty',
     '/dev/input/event,thermald',
     '/dev/input/event,touchegg',
     '/dev/input/event,Xorg',

detection/credentials/yara-mounted-stealer.sql

@@ -65,17 +65,18 @@ WHERE
   AND yara.sigrule = '    
     rule stealer {
     strings:
-        $ds = "data_stealers" ascii
-        $lk = "/Library/Keychains" ascii
-        $cs = "cookies.sqlite" ascii
-        $mc = "moz_cookies" ascii
-        $og = "OperaGX" ascii
-        $bs = "BraveSoftware" ascii
-        $os = "osascript" ascii
-        $fgp = "find-generic-password" ascii
+        $data_stealers = "data_stealers" ascii
+        $library_keychains = "/Library/Keychains" ascii
+        $cookies_sqlite = "cookies.sqlite" ascii
+        $moz_cookies = "moz_cookies" ascii
+        $operagx = "OperaGX" ascii
+        $brave_software = "BraveSoftware" ascii
+        $osascript = "osascript" ascii
+        $find_generic_password = "find-generic-password" ascii
 
     condition:
         2 of them
 }'
-  AND yara.count > 0  
-GROUP BY file.path
+  AND yara.count > 0
+GROUP BY
+  file.path

detection/evasion/name_path_mismatch.sql

@@ -89,6 +89,7 @@ WHERE
     '0,udevadm,systemd-udevd',
     '0,udevadm,(udev-worker)',
     '500,netcat,nc',
+    '500,nc.openbsd,nc',
     '500,busybox,sh',
     '500,coreutils,tail',
     '500,gjs-console,gnome-character',

detection/evasion/touched-executable-linux.sql

@@ -41,6 +41,6 @@ WHERE
   AND f.path NOT LIKE '/usr/local/aws-cli/%/dist/aws'
   AND f.path NOT LIKE '/usr/local/kolide-k2/bin/%-updates/%'
   AND f.path NOT LIKE '/tmp/go-build%'
-  AND p.name != 'osqtool'
+  AND p.name NOT LIKE 'osqtool%'
 GROUP by
   p.pid

detection/evasion/unexpected-etc-executables.sql

@@ -33,6 +33,7 @@ WHERE
     '/etc/alternatives',
     '/etc/apcupsd',
     '/etc/apm/resume.d',
+    '/etc/vmware-tools/scripts/vmware',
     '/etc/apm/scripts.d',
     '/etc/apm/suspend.d',
     '/etc/avahi',

detection/evasion/unexpected-var-run-linux.sql

@@ -33,6 +33,12 @@ WHERE
     'apcupsd.pid',
     'apport.lock',
     'atd.pid',
+    'adduser',
+    'lima-boot-done',
+    'lima-ssh-ready',
+    'machine-id',
+    'motd.dynamic',
+    'multipathd.pid',
     'auditd.pid',
     'cron.reboot',
     'crond.pid',

detection/exfil/yara-unexpected-go-crypt-exec-process.sql

@@ -74,6 +74,8 @@ WHERE
     'kubectl',
     'go',
     'docker',
+    'lima-guestagent',
+    'containerd-star',
     'gopls',
     'launcher',
     'tflint',

detection/persistence/unexpected-active-systemd-units.sql

@@ -55,6 +55,10 @@ WHERE
         'accounts-daemon.service,Accounts Service,',
         'acpid.path,ACPI Events Check,',
         'acpid.service,ACPI Daemon,',
+        '[email protected],Serial Getty on hvc0,',
+        'ssh.socket,OpenBSD Secure Shell server socket,',
+        'launcher,/usr/local/kolide-k2/bin/launcher,0,system.slice,launcher.kolide-k2.service,0755',
+        'systemd-machine-id-commit.service,Commit a transient machine-id on disk,',
         'acpid.service,ACPI event daemon,',
         'acpid.socket,ACPID Listen Socket,',
         'akmods.service,Builds and install new kmods from akmod packages,',

detection/persistence/unexpected-device.sql

@@ -118,6 +118,8 @@ WHERE
     '/dev/loop',
     '/dev/loop-control',
     '/dev/lp',
+    '/dev/hvc',
+    '/dev/vportp',
     '/dev/mapper/',
     '/dev/mapper/control',
     '/dev/mcelog',

detection/persistence/unexpected-listening-port-linux.sql

@@ -70,6 +70,9 @@ WHERE
   ) IN (
     '10250,6,0,kubelet',
     '10250,6,500,kubelet',
+    '22,6,0,systemd',
+    '58,255,500,systemd-network',
+    '68,17,500,systemd-network',
     '10254,6,101,nginx-ingress-c',
     '10256,6,0,kube-proxy',
     '10256,6,500,kube-proxy',

detection/persistence/unexpected-uid0-daemon-linux.sql

@@ -75,6 +75,8 @@ WHERE
   AND p0.start_time < (strftime('%s', 'now') - 1200)
   AND exception_key NOT IN (
     '(sd-pam),/usr/lib/systemd/systemd,0,user.slice,user-0.slice,0755',
+    'sshd,/usr/sbin/sshd,0,user.slice,user-501.slice,0755',
+    'launcher,/usr/local/kolide-k2/bin/launcher,0,system.slice,launcher.kolide-k2.service,0755',
     '.tailscaled-wra,/nix/store/__VERSION__/bin/.tailscaled-wrapped,0,system.slice,tailscaled.service,0555',
     '/usr/bin/monito,/usr/bin/perl,0,system.slice,monitorix.service,0755',
     'ModemManager,/usr/sbin/ModemManager,0,system.slice,ModemManager.service,0755',

detection/persistence/yara-suspicious-strings-process-linux.sql

@@ -89,6 +89,7 @@ WHERE
     '/usr/bin/gnome-software',
     '/usr/bin/gpg-agent',
     '/usr/bin/ibus-daemon',
+    '/usr/bin/make',
     '/usr/bin/NetworkManager',
     '/usr/bin/nvidia-persistenced',
     '/usr/bin/pulseaudio',