AttackSurfaceAnalyzer/filters.json

52 строки
793 B
JSON
Исходник Постоянная ссылка Обычный вид История

{
Fixes and improvements (#264) * Logging and registry collector fixes. * Add groundwork for highlighting individual changes within an item (for example, changes in a reg key, what specific field changed in a file) * Logging and registry collector fixes. * Add a 'quiet' collection mode. * All collectors now implicitly enables certificate collection from files. * Fix for certificate modification detection. Improved compare performance. * Simplify directory walker. Improve certificate collector behavior. * Remove spare file. * Removing global.json * Multiple fixes to diff generation. * Fix oververbose serialization. * Simplify registry output. * Now show string values in diffs. * More filters. More json serialization fixes. * Update logging messages for filter.cs * Simplify line. * Clean up FirstRun variable. * Now support parsing properties of objects in addition to just values. * Adds a Modified Diff type for single field modifications (not modifications to a list or dictionary) * Improve output of modified dictionary entries (such as registry values). * Update packages. Fix GUI build break. * Add Group detection to Windows * Group collector for linux. * Group collection for Mac OS * Add Owner/Group to linux and mac file collectors. * Add SetUid and SetGid detection fix #132 * Create default analysis rule to flag Gid/Uid * Clean up some verbose logging statements. * Build fix. * Possible fix for memory usage. * Fix modified query. * Add docker experiments files. * Fix issue with writing to database. Added STARTS_WITH operation support. * Improve analyser to support properties properly. * Crash fix. Cleanup. Improve file system collector stability when handling multiple large roots. * Filter out Windows\Temp * Re-fixes "download-cloud" setting. * Registry Collector fixes and improvements. Many collector's database behavior updated. * Adds more analysis rules. * Fixes result count in list-runs command. * Improves result count in list-runs * Tested working certificates from files collector. * logging cleanup. Property fix. * Removing json file. * Regenerate documentation. * Updated docs. * One more stab at documentation generation automation. * Updated documentation files. * Move Enums into their own namespace * Documentation update for previous commit. * Better doc setup. * Build fix. * Shuffle variable order. * Run formatter. * Formatting in Gui.
2019-09-05 01:49:13 +03:00
"WINDOWS": {
"Scan": {
"Registry": {
"Key": {
"Exclude": [
]
},
},
"File": {
"Path": {
"Exclude": [
"^[A-Z]:\\\\pagefile.sys$",
"^[A-Z]:\\\\hiberfil.sys$",
"^[A-Z]:\\\\swapfile.sys$",
]
}
}
}
},
"MACOS": {
"Monitor": {
"File": {
"Path": {
"Exclude": [
"/private/var/db/uuidtext",
"/dev"
]
}
}
},
"Scan": {
"File": {
"Path": {
"Exclude": [
"^/.Spotlight-V100"
]
}
}
}
},
Fixes and improvements (#264) * Logging and registry collector fixes. * Add groundwork for highlighting individual changes within an item (for example, changes in a reg key, what specific field changed in a file) * Logging and registry collector fixes. * Add a 'quiet' collection mode. * All collectors now implicitly enables certificate collection from files. * Fix for certificate modification detection. Improved compare performance. * Simplify directory walker. Improve certificate collector behavior. * Remove spare file. * Removing global.json * Multiple fixes to diff generation. * Fix oververbose serialization. * Simplify registry output. * Now show string values in diffs. * More filters. More json serialization fixes. * Update logging messages for filter.cs * Simplify line. * Clean up FirstRun variable. * Now support parsing properties of objects in addition to just values. * Adds a Modified Diff type for single field modifications (not modifications to a list or dictionary) * Improve output of modified dictionary entries (such as registry values). * Update packages. Fix GUI build break. * Add Group detection to Windows * Group collector for linux. * Group collection for Mac OS * Add Owner/Group to linux and mac file collectors. * Add SetUid and SetGid detection fix #132 * Create default analysis rule to flag Gid/Uid * Clean up some verbose logging statements. * Build fix. * Possible fix for memory usage. * Fix modified query. * Add docker experiments files. * Fix issue with writing to database. Added STARTS_WITH operation support. * Improve analyser to support properties properly. * Crash fix. Cleanup. Improve file system collector stability when handling multiple large roots. * Filter out Windows\Temp * Re-fixes "download-cloud" setting. * Registry Collector fixes and improvements. Many collector's database behavior updated. * Adds more analysis rules. * Fixes result count in list-runs command. * Improves result count in list-runs * Tested working certificates from files collector. * logging cleanup. Property fix. * Removing json file. * Regenerate documentation. * Updated docs. * One more stab at documentation generation automation. * Updated documentation files. * Move Enums into their own namespace * Documentation update for previous commit. * Better doc setup. * Build fix. * Shuffle variable order. * Run formatter. * Formatting in Gui.
2019-09-05 01:49:13 +03:00
"LINUX": {
"Scan": {
"File": {
"Path": {
"Exclude": [
]
}
}
}
Fixes and improvements (#264) * Logging and registry collector fixes. * Add groundwork for highlighting individual changes within an item (for example, changes in a reg key, what specific field changed in a file) * Logging and registry collector fixes. * Add a 'quiet' collection mode. * All collectors now implicitly enables certificate collection from files. * Fix for certificate modification detection. Improved compare performance. * Simplify directory walker. Improve certificate collector behavior. * Remove spare file. * Removing global.json * Multiple fixes to diff generation. * Fix oververbose serialization. * Simplify registry output. * Now show string values in diffs. * More filters. More json serialization fixes. * Update logging messages for filter.cs * Simplify line. * Clean up FirstRun variable. * Now support parsing properties of objects in addition to just values. * Adds a Modified Diff type for single field modifications (not modifications to a list or dictionary) * Improve output of modified dictionary entries (such as registry values). * Update packages. Fix GUI build break. * Add Group detection to Windows * Group collector for linux. * Group collection for Mac OS * Add Owner/Group to linux and mac file collectors. * Add SetUid and SetGid detection fix #132 * Create default analysis rule to flag Gid/Uid * Clean up some verbose logging statements. * Build fix. * Possible fix for memory usage. * Fix modified query. * Add docker experiments files. * Fix issue with writing to database. Added STARTS_WITH operation support. * Improve analyser to support properties properly. * Crash fix. Cleanup. Improve file system collector stability when handling multiple large roots. * Filter out Windows\Temp * Re-fixes "download-cloud" setting. * Registry Collector fixes and improvements. Many collector's database behavior updated. * Adds more analysis rules. * Fixes result count in list-runs command. * Improves result count in list-runs * Tested working certificates from files collector. * logging cleanup. Property fix. * Removing json file. * Regenerate documentation. * Updated docs. * One more stab at documentation generation automation. * Updated documentation files. * Move Enums into their own namespace * Documentation update for previous commit. * Better doc setup. * Build fix. * Shuffle variable order. * Run formatter. * Formatting in Gui.
2019-09-05 01:49:13 +03:00
}
}