From 0c7e8b569a45670bfac4ab2c14923b104d7bbf93 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 1/7] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index ab02082..d86dcb2 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -32,8 +32,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"] +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 7476a1edca941b70a4a6673abf9a23d22d98dcf5 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 2/7] Updated Bad Lists --- AirlockTools.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/AirlockTools.py b/AirlockTools.py index 180d624..ac76d31 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,8 +34,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] +<<<<<<< HEAD pups = ["logmein", "invalid" , "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 0b0fe288f1d2134f39f8f8a536633f65fd440682 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 3/7] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 6454786..c872edc 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,7 +34,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 536227f3bebda9fcdc938bbeb626875bb044aafa Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 4/7] Rebased PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 9180503..501b8ce 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 From 92de8565bde7465d6e8b8132ed695db54f8c12e3 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 5/7] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 501b8ce..91f1186 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,8 +35,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 49e02651f6becf382d1fd0de3b242a129aac2c35 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 6/7] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 91f1186..956d140 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 2dd7b6fb48c2d932c96be2143e9d1fef0ddbf426 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 7/7] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 956d140..a07c46d 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4