From 0c7e8b569a45670bfac4ab2c14923b104d7bbf93 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 1/3] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index ab02082..d86dcb2 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -32,8 +32,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"] +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 7476a1edca941b70a4a6673abf9a23d22d98dcf5 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 2/3] Updated Bad Lists --- AirlockTools.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/AirlockTools.py b/AirlockTools.py index 180d624..ac76d31 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,8 +34,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] +<<<<<<< HEAD pups = ["logmein", "invalid" , "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 0b0fe288f1d2134f39f8f8a536633f65fd440682 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 3/3] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 6454786..c872edc 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,7 +34,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4