From 1c7560c7e0cd27f8b909b60569d8d2ef8eea975c Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 01/29] Rebased PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 6d1b728..c1a1f16 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 From f02c42e05e59248d05c5eab055be38a99eeb026a Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 02/29] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index c1a1f16..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From c81073ef231c4a5932837e1eaae7bff62e2defc8 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 03/29] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 8bc3f1a7799bd3d99cbf38c845b3e414393556eb Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 04/29] Updated Bad Lists --- AirlockTools.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..fc3fa25 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +<<<<<<< HEAD +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From caa32b9151eaf32289afb950e66f5c4752cd1064 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 05/29] Updated Bad Lists --- AirlockTools.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index fc3fa25..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,13 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -<<<<<<< HEAD -pups = ["logmein", "invalid" , "nmap"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] -======= pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] ->>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 4260b213ead45cce3cb9832b01017d244493d15f Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 06/29] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 49ca81a548b32edecd0db18cd047db2a44764c3f Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 07/29] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..958cec8 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 0aa313d893f599b63390110ec02014772b04c4e7 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 08/29] Rebased PUPS --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 958cec8..c1a1f16 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] +badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From fabe2795f0986f24014fe324c455b9a03741fe92 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 09/29] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index c1a1f16..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From c17034d2fe07f7464eb5f6701e86a169f6398f52 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 10/29] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 385dbfe769728196fd9a0ea058608f80006de76e Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 11/29] Updated Bad Lists --- AirlockTools.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..fc3fa25 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +<<<<<<< HEAD +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From c21d0a86fa184124301f1f80c346e7cd8d264557 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 12/29] Updated Bad Lists --- AirlockTools.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index fc3fa25..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,13 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -<<<<<<< HEAD -pups = ["logmein", "invalid" , "nmap"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] -======= pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] ->>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 0ef9efc9f7c366f1953fe99a47a48f731d8e7b88 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 13/29] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From d05e5b9d8b8078cd174bcf6aef53fb907dced4cf Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 14/29] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..958cec8 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 81fed143ee3bd6ac6a69599e3fe21e0e247483f1 Mon Sep 17 00:00:00 2001 From: Zarithas Date: Wed, 1 Oct 2025 11:15:13 -0400 Subject: [PATCH 15/29] Update utils/policyfunctions.py Fixed botched rename --- utils/policyfunctions.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/utils/policyfunctions.py b/utils/policyfunctions.py index b1d9e52..b996238 100644 --- a/utils/policyfunctions.py +++ b/utils/policyfunctions.py @@ -602,7 +602,7 @@ def getMultiplePolicySelections(url): policynameslist = [] policyidlist = [] while True: - choice, policynames, policyid = listPolicies(url) + choice, policynames, policyid = choosePolicies(url) selected_policy = policynames[choice] selected_policyid = policyid[choice] From f00401b6fe873de2243845569e3e91c43aad6e35 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 16/29] Rebased PUPS --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 958cec8..c1a1f16 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] +badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 155584259ea6d12c5d347a8e15cd482c66fbd23d Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 17/29] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index c1a1f16..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From b2006bb75daf48ef60e3df122f59af1c6ef09f58 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 18/29] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From fd81236c4582f967a242735229d7114822d05432 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 19/29] Updated Bad Lists --- AirlockTools.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..fc3fa25 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +<<<<<<< HEAD +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 7ff3aff611014e42775710784b879a7ebf501708 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 20/29] Updated Bad Lists --- AirlockTools.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index fc3fa25..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,13 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -<<<<<<< HEAD -pups = ["logmein", "invalid" , "nmap"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] -======= pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] ->>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From a576bba1f4834e8bdd884bac6f425511fec1e6e9 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 21/29] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From f5ea29886ed169b07bdb355a492a52ea76c70a8e Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 22/29] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..958cec8 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 49570fd386b41d06dce26eeb791c3d911713bbb6 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 23/29] Rebased PUPS --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 958cec8..c1a1f16 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] +badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From cc59db74fb5819d225b2e14bbafa8cc8d2a3d965 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 24/29] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index c1a1f16..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 2d7cd2ff95ff5f052908a405f61f1202f99e6a5f Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 25/29] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 294a1fb76a728eb87c4fbf56966523b41d6e7b04 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 26/29] Updated Bad Lists --- AirlockTools.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..fc3fa25 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,8 +31,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +<<<<<<< HEAD +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From ee916d568d0a018222df084ca547cff6cdaaeb7a Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 27/29] Updated Bad Lists --- AirlockTools.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index fc3fa25..22c06c7 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,13 +31,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -<<<<<<< HEAD -pups = ["logmein", "invalid" , "nmap"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] -======= pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] ->>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 26f8d4a85d21ec4a03e9d82723e3ea69a574d194 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 28/29] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 22c06c7..5923c22 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 91535f12e7ce049d916a770414d3a58001686d26 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 29/29] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 5923c22..958cec8 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -31,7 +31,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4