fpr: ThingsWidgetExtension

chainguard-dev · Nov 2, 2023 · 40078d3 · 40078d3
1 parent 5802021
commit 40078d3
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/detection/evasion/unusual-process-name-macos.sql b/detection/evasion/unusual-process-name-macos.sql
@@ -97,6 +97,7 @@ WHERE
   AND NOT pname IN (
     'cpu',
     'com.microsoft.teams2.notificationcenter',
+    'ThingsWidgetExtensionMacAppStore',
     'at.obdev.littlesnitch.endpointsecurity',
     'BetterTouchToolAppleScriptRunner',
     'BetterTouchToolShellScriptRunner',
@@ -106,4 +107,4 @@ WHERE
   )
   -- example: 85C27NK92C.com.flexibits.fantastical2.mac.helper
   AND NOT pname LIKE "%.com.flexibits.fantastical2.mac.helper"
-  AND NOT s.authority = "Software Signing"
+  AND NOT s.authority IN ("Software Signing","Apple Mac OS Application Signing")