osquery-defense-kit/detection/execution/unexpected-tmp-executables.sql

-- Find unexpected executables in temp directories
SELECT
  file.path,
  uid,
  gid,
  mode,
  file.mtime,
  file.size,
  hash.sha256,
  magic.data
FROM
  file
  LEFT JOIN hash on file.path = hash.path
  LEFT JOIN magic ON file.path = magic.path
WHERE
  (
    -- Recursive queries don't seem to work well with hidden directories :(
    file.path LIKE '/tmp/%%'
    OR file.path LIKE '/tmp/.%/%%'
    OR file.path LIKE '/tmp/%/%%'
    OR file.path LIKE '/tmp/%/%/.%'
    OR file.path LIKE '/tmp/%/.%/%%'
    OR file.path LIKE '/var/tmp/%%'
    OR file.path LIKE '/var/tmp/.%/%%'
    OR file.path LIKE '/var/tmp/%/%%'
    OR file.path LIKE '/var/tmp/%/%/.%'
    OR file.path LIKE '/var/tmp/%/.%/%%'
    OR file.path LIKE '/var/spool/%%'
    OR file.path LIKE '/var/spool/.%/%%'
    OR file.path LIKE '/var/spool/%/%%'
    OR file.path LIKE '/var/spool/%/%/.%'
    OR file.path LIKE '/var/spool/%/.%/%%'
    OR file.path LIKE '/dev/mqueue/%%'
    OR file.path LIKE '/dev/mqueue/.%/%%'
    OR file.path LIKE '/dev/mqueue/%/%%'
    OR file.path LIKE '/dev/mqueue/%/%/.%'
    OR file.path LIKE '/dev/mqueue/%/.%/%%'
    OR file.path LIKE '/dev/shm/%%'
    OR file.path LIKE '/dev/shm/.%/%%'
    OR file.path LIKE '/dev/shm/%/%%'
    OR file.path LIKE '/dev/shm/%/%/.%'
    OR file.path LIKE '/dev/shm/%/.%/%%'
  )
  AND file.type = 'regular'
  AND file.path NOT LIKE '%/../%'
  AND file.path NOT LIKE '%/./%'
  AND (
    file.mode LIKE '%7%'
    or file.mode LIKE '%5%'
    or file.mode LIKE '%1%'
  )
  AND NOT (
    uid > 500
    AND (
      file.path LIKE '%/go-build%'
      OR file.path LIKE '/tmp/checkout/%'
      OR file.path LIKE '/tmp/com.apple.installer%'
      OR file.path LIKE '/tmp/flow/%.npmzS_cacachezStmpzSgit-clone%'
      OR file.path LIKE '/tmp/%/site-packages/markupsafe/_speedups.cpython-%'
      OR file.path LIKE '/tmp/go.%.sum'
      OR file.path LIKE '/tmp/guile-%/guile-%'
      OR file.path LIKE '/tmp/terraformer/%'
      OR file.path LIKE '/tmp/tmp.%'
      OR file.path LIKE '%/bin/%-gen'
      OR file.path LIKE '%/bin/%'
      OR file.path LIKE '%/CCLBS/%'
      OR file.path LIKE '%/ko/%'
      OR file.path LIKE '%/pdf-tools/%'
      OR file.path LIKE '%/tmp/epdf%'
      OR
      -- These regular expressions can be narrowed down
      (
        file.size < 4000
        AND file.path LIKE '/tmp/%.sh'
      )
      OR (
        file.size < 4000
        AND file.path LIKE '/tmp/%.py'
      )
    )
  )
  -- Nix
  AND NOT (
    file.directory LIKE '/tmp/tmp%'
    AND gid = 0
    AND uid > 300
    AND uid < 350
  )
  AND NOT magic.data LIKE '%nix-shell script%'
  -- Don't alert if the file is only on disk for a moment
  AND NOT (
    file.directory LIKE '/tmp/%'
    AND (strftime('%s', 'now') - ctime) < 60
  )
  -- macOS updates
  AND NOT file.directory LIKE '/tmp/msu-target-%'
  -- I don't know man. I don't work here.
  AND NOT (
    file.path LIKE('/tmp/%compressed')
    AND size < 4000
    AND uid > 500
  )
  -- Executables too small to even hold '#!/bin/sh\nuid'
  AND NOT (
    file.type = 'regular'
    AND size < 10
  )