Sentrix/sentrix.example.toml at main · pd241008/Sentrix · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
# Sentrix Configuration File
# Customize detection patterns and scan settings

# General settings
recent_file_days = 3

# Windows-specific patterns
[windows]
suspicious_autorun_patterns = [
    "powershell -enc",
    "-windowstyle hidden",
    "\\appdata\\local\\temp",
    "\\users\\public",
    "mshta",
    "certutil -decode",
]
suspicious_task_actions = [
    "powershell",
    "cmd /c",
    "mshta",
    "certutil",
    "\\temp\\",
    "\\appdata\\",
    "\\users\\public",
]
suspicious_powershell_patterns = [
    "invoke-expression",
    "iex(",
    "iex (",
    "downloadstring",
    "invoke-webrequest",
    "start-process",
    "encodedcommand",
    "frombase64string",
    "bitstransfer",
    "start-bitstransfer",
    "invoke-cimmethod",
    "get-wmiobject",
    "hidden",
    "-nop",
    "-noni",
    "bypass",
    "downloadfile",
    "invoke-restmethod",
    "new-object net.webclient",
]
suspicious_service_patterns = [
    "\\temp\\",
    "\\appdata\\local\\temp",
    "\\users\\public",
    "powershell",
    "cmd /c",
    "mshta",
    "certutil",
]
wmi_event_consumer_patterns = [
    "powershell",
    "cmd /c",
    "mshta",
    "certutil",
    "wscript",
    "cscript",
]

# macOS-specific patterns
[macos]
suspicious_plist_patterns = ["curl", "wget", "/tmp/", "base64"]
suspicious_cron_patterns = ["curl", "wget", "base64", "/tmp/"]
suspicious_launchctl_output = ["curl", "wget", "/tmp/", "base64", "mshta", "powershell"]

# Network/system extension name patterns that trigger a flag.
network_extension_patterns = ["filter", "proxy", "dns", "vpn", "firewall", "monitor", "capture"]

# Identifier prefixes that exempt an extension from flagging. Without an
# allowlist, standard macOS bundle IDs (almost all starting with "com.")
# would flood the report with false positives.
network_extension_allowlist = [
    "com.apple.",
    "com.cisco.",
    "com.crowdstrike.",
    "com.dtna.",
    "com.egnyte.",
    "com.google.",
    "com.cloudflare.",
    "com.jamf.",
    "com.kandji.",
    "com.malwarebytes.",
    "com.microsoft.",
    "com.netskope.",
    "com.paloaltonetworks.",
    "com.sentinelone.",
    "com.sophos.",
    "com.1e.",
    "com.1password.",
    "com.zscaler.",
    "org.mozilla.",
    "ch.protonvpn.",
    "net.tunnelblick.",
]

shell_rc_files = [".zshrc", ".bash_profile", ".zprofile"]

# Linux-specific settings
[linux]
shell_rc_files = [".bashrc", ".profile"]
persistence_scan_dirs = ["/etc", "/usr/local/bin"]