vortichem.blogg.se - Osquery packs

OSQUERY PACKS UPGRADE
OSQUERY PACKS CODE
OSQUERY PACKS SERIES
OSQUERY PACKS WINDOWS

tables => acpi_tables => ad_config => alf => alf_exceptions => alf_explicit_auths Įach table has a specified and schema, which identifies the available columns, column types, and descriptive details The schema of a table can be viewed using the. The list of available tables can be explored using the. Here’s a sample query for the host name and CPU type of a given system: $ osqueryi osquery> SELECT hostname, cpu_type from system_info +-+-+ | hostname | cpu_type | +-+-+ | mycomputer | x86_64 | +-+-+ Queries are issued either through osqueryi, an interactive SQL environment, or osqueryd, a long-lived daemon for execution of repeated, scheduled queries. Users can interrogate the system state with SQL queries against these tables. Osquery collects and aggregates a system’s log and status information in a collection of pre-defined tables. Within 24 hours, we had a comprehensive list of hosts that had dnsmasq installed and could target them for removal/updates. Before we began, we already had two of these queries in place, and adding the two additional dnsmasq-specific queries only took a matter of minutes. This approach is much more thorough than simply enumerating installed packages on a host.

Find users who installed dnsmasq via Homebrew: SELECT * FROM homebrew_packages WHERE name='dnsmasq'.

Discover hosts that are have dnsmasq listening on localhost port 53: SELECT DISTINCT(processes.name), process_open_sockets.local_port FROM processes JOIN process_open_sockets USING (pid) WHERE local_port=53 AND processes.name='dnsmasq'.

Find running Docker containers with dnsmasq in the name: SELECT name FROM docker_containers WHERE name LIKE '%dnsmasq%'.

Find dnsmasq installed via Homebrew or MacPorts by enumerating related launchd plist: SELECT * FROM launchd WHERE name LIKE '%dnsmasq%'.

To ensure we were able to thoroughly inventory every host with any form of dnsmasq installed, we used four separate queries: To make the situation more complex, some development teams were using a dnsmasq Docker image as part of their development workflow, so identifying dnsmasq installations would not be as simple as searching through installed programs.

OSQUERY PACKS UPGRADE

Case study: dnsmasq vulnerabilitiesĪfter Google’s security team published their blog detailing the numerous vulnerabilities with dnsmasq, our InfoSec team spun up an effort to remove dnsmasq wherever it was installed and upgrade dnsmasq to the patched version wherever it was still required.

OSQUERY PACKS SERIES

Multiple RCE vulnerabilities were discovered in dnsmasq a widely and commonly used applicationĮach of these incidents required the capability to ask a series of “questions” to the entirety of a fleet in order to identify impacted systems.

A release of CCleaner.exe was packaged with a malicious backdoor.

OSQUERY PACKS CODE

A handful of Chrome extensions were hijacked to serve malicious code.

OSQUERY PACKS WINDOWS

The public release of tools that allowed unskilled adversaries to exploit a previously unknown vulnerability in Windows systems.In 2017, several notable public events occurred which necessitated rapid response and deep introspection of endpoint and application configuration: Our configuration represents a baseline security standard that can deliver immediate security outcomes for detection and response when used in conjunction with a centralized logging platform. The GitHub project provides the necessary building blocks and serves as a useful reference for organizations to rapidly evaluate and deploy osquery to a production environment.

The goal of this blog post is twofold: first, to provide configuration guidance for a multi-platform osquery deployment, and second to describe our open-source set of osquery configurations. By issuing SQL-like queries against these tables, users can collect valuable data about the current state of the system as well as changes applied to it over time. osquery is an open-source tool originally developed at Facebook that exposes operating system configuration data in the form of relational database tables. Palantir currently maintains an osquery deployment across Windows, Mac, and Linux systems to answer these questions. While endpoint detection and protection tools can provide some lift out-of-the-box, deep insight and analysis of security-relevant events is crucial to detecting advanced threats. Incident detection and response across thousands of hosts requires a deep understanding of actions and behavior across users, applications, and devices. Every effective Incident Response team needs the ability to “ask a question” to a single or multiple hosts in the fleet and receive timely and accurate answers.