From 0c7e8b569a45670bfac4ab2c14923b104d7bbf93 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 01/14] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index ab02082..d86dcb2 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -32,8 +32,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata"] +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 7476a1edca941b70a4a6673abf9a23d22d98dcf5 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 02/14] Updated Bad Lists --- AirlockTools.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/AirlockTools.py b/AirlockTools.py index 180d624..ac76d31 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,8 +34,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] +<<<<<<< HEAD pups = ["logmein", "invalid" , "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 0b0fe288f1d2134f39f8f8a536633f65fd440682 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 03/14] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 6454786..c872edc 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -34,7 +34,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 536227f3bebda9fcdc938bbeb626875bb044aafa Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 04/14] Rebased PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 9180503..501b8ce 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 From 92de8565bde7465d6e8b8132ed695db54f8c12e3 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 05/14] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 501b8ce..91f1186 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,8 +35,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 49e02651f6becf382d1fd0de3b242a129aac2c35 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 06/14] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 91f1186..956d140 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 2dd7b6fb48c2d932c96be2143e9d1fef0ddbf426 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 07/14] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 956d140..a07c46d 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -35,7 +35,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 7ba125c662059b3ccdef29658fad5e7dd5e0266c Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:33:53 -0400 Subject: [PATCH 08/14] Rebased PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 8da894c..72bfd9a 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,7 +30,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] +pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 path_exclusion_constant = 4 min_files_for_path = 4 From 7c99a5c0e55f1f2c6258daed95c20d576c61d15e Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 09/14] Updated Bad Lists --- AirlockTools.py | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index 72bfd9a..27bf088 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,8 +30,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid" , "nmap", "VNC", "Kaseya", "Solarwinds", "mRemoteNG", "LTSvc"] -badpathparts = ["users", "wwwroot", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", ] #"Windows\\assembly", "WindowsPowerShell\\Modules", "windows\\temp"3 +pups = ["logmein", "invalid", "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 4d407d59627cccfe135972a793a71fb52fbe5ad3 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 10/14] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 27bf088..981aa5b 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,7 +30,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 5cd3d39c21457a152f048b9b6ef44c928139e01b Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 11/14] Updated Bad Lists --- AirlockTools.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 981aa5b..d74d197 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,8 +30,13 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +<<<<<<< HEAD +pups = ["logmein", "invalid" , "nmap"] +badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] +======= +pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] +>>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From 641c0c55516aeb35f6546a55cddce56d0848ff0d Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Tue, 9 Sep 2025 12:22:10 -0400 Subject: [PATCH 12/14] Updated Bad Lists --- AirlockTools.py | 5 ----- 1 file changed, 5 deletions(-) diff --git a/AirlockTools.py b/AirlockTools.py index d74d197..27bf088 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,13 +30,8 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -<<<<<<< HEAD -pups = ["logmein", "invalid" , "nmap"] -badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya", "Windows\\assembly", "WindowsPowerShell\\Modules"] -======= pups = ["logmein", "invalid", "nmap"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] ->>>>>>> 0c7e8b5 (Updated Bad Lists) path_exclusion_constant = 4 min_files_for_path = 4 threat_tolerance_constant = 4 From bee70c079b0dac68accedb9264f2e8f604fa6aff Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:23:39 -0400 Subject: [PATCH 13/14] Added LTSvc --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 27bf088..981aa5b 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,7 +30,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap"] +pups = ["logmein", "invalid", "nmap", "LTSvc"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4 From 2fb65f8b5cc567c1ab43f7564cd4f042c6e3e589 Mon Sep 17 00:00:00 2001 From: brotoskyj Date: Wed, 24 Sep 2025 09:42:53 -0400 Subject: [PATCH 14/14] Added New PUPS --- AirlockTools.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/AirlockTools.py b/AirlockTools.py index 981aa5b..5618e9d 100644 --- a/AirlockTools.py +++ b/AirlockTools.py @@ -30,7 +30,7 @@ dotenv.load_dotenv() #Constants url = os.getenv('url') bad_publisher_list = ["Brave","Zoom", "GlavSoft", "VNC"] -pups = ["logmein", "invalid", "nmap", "LTSvc"] +pups = ["logmein", "invalid", "nmap", "LTSvc", "VNC", "Kaseya", "Solarwinds", "mRemoteNG"] badpathparts = ["users", "wwwroot", "windows\\temp", "windows\\task", "windows\\system32", "startup", "windows\\fonts", "Recycle.Bin", "AppData", "programdata", "Solarwinds", "kaseya"] path_exclusion_constant = 4 min_files_for_path = 4