Merge pull request #335 from tstromberg/fpr-nov2

fpr: ThingsWidgetExtension
chainguard-dev · Nov 2, 2023 · 803f21c · 803f21c
2 parents 9e9da12 + 40078d3
commit 803f21c
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/detection/evasion/unusual-process-name-macos.sql b/detection/evasion/unusual-process-name-macos.sql
@@ -97,6 +97,7 @@ WHERE
   AND NOT pname IN (
     'cpu',
     'com.microsoft.teams2.notificationcenter',
+    'ThingsWidgetExtensionMacAppStore',
     'at.obdev.littlesnitch.endpointsecurity',
     'BetterTouchToolAppleScriptRunner',
     'BetterTouchToolShellScriptRunner',
@@ -106,4 +107,4 @@ WHERE
   )
   -- example: 85C27NK92C.com.flexibits.fantastical2.mac.helper
   AND NOT pname LIKE "%.com.flexibits.fantastical2.mac.helper"
-  AND NOT s.authority = "Software Signing"
+  AND NOT s.authority IN ("Software Signing","Apple Mac OS Application Signing")