osquery-defense-kit/process/name_path_mismatch.sql

75 lines
2.6 KiB
MySQL
Raw Normal View History

2022-09-09 16:51:52 +00:00
SELECT p.name,
2022-09-21 14:30:17 +00:00
TRIM(SUBSTR(SPLIT(p.name, ":./ ", 0), 0, 15)) AS short_name,
TRIM(SUBSTR(SPLIT(f.filename, ":./ ", 0), 0, 15)) AS short_filename,
2022-09-09 16:51:52 +00:00
f.filename,
p.path,
2022-09-21 14:30:17 +00:00
p.cwd,
p.cmdline AS cmd,
pp.path AS parent_path,
pp.name AS parent_name,
pp.cmdline AS parent_cmd,
pp.cwd AS parent_cwd,
pp.euid AS parent_euid,
hash.sha256 AS child_sha256,
phash.sha256 AS parent_sha256,
CONCAT(
'name=',
TRIM(SUBSTR(SPLIT(p.name, ":./ ", 0), 0, 15)),
',file=',
TRIM(SUBSTR(SPLIT(f.filename, ":./ ", 0), 0, 15)),
',',
2022-09-22 09:18:03 +00:00
MIN(p.uid, 500)
2022-09-21 14:30:17 +00:00
) AS exception_key
2022-09-09 16:51:52 +00:00
FROM processes p
2022-09-21 14:30:17 +00:00
LEFT JOIN file f ON p.path = f.path
LEFT JOIN processes pp ON p.parent = pp.pid
LEFT JOIN hash ON p.path = hash.path
LEFT JOIN hash AS phash ON pp.path = phash.path
2022-09-15 13:34:45 +00:00
WHERE short_filename != short_name
2022-09-22 09:18:03 +00:00
AND NOT cmd LIKE "/nix/store/%/bin/bash%" -- Serial masqueraders
AND NOT short_filename IN (
'bash',
'ruby',
'python',
'python3'
)
AND exception_key NOT IN (
'name=(sd-pam),file=systemd,500',
2022-09-22 17:18:16 +00:00
'name=(sd-pam),file=systemd,127',
2022-09-22 09:18:03 +00:00
'name=chrome-gnome-s,file=python3,500',
'name=code-oss,file=electron,500',
'name=firefox-wrappe,file=firefox,500',
'name=blueman-tray,file=python3,500',
'name=firewalld,file=python3,0',
'name=gjs,file=gjs-console,500',
'name=gnome-tweak-to,file=python3,500',
'name=gsettings-hel,file=gsettings-help,500',
'name=Isolated,file=firefox,500',
'name=sd_espeak-ng-m,file=sd_espeak-ng,500',
'name=mysqld,file=mariadbd,500',
'name=networkd-dispa,file=python3,0',
'name=MainThread,file=plugin-contain,500',
'name=nix-daemon,file=nix,0',
'name=npm,file=node,500',
2022-09-22 23:35:24 +00:00
'name=slic3r_main,file=prusa-slicer,500',
2022-09-22 09:18:03 +00:00
'name=osqueryi,file=osqueryd,500',
'name=blueman-applet,file=python3,500',
'name=phpstorm,file=dash,500',
'name=Privileged,file=firefox,500',
'name=RDD,file=firefox,500',
'name=sh,file=dash,0',
'name=zoom,file=ZoomLauncher,500',
'name=sh,file=dash,500',
'name=Socket,file=firefox,500',
'name=streamdeck,file=python3,500',
'name=systemd-udevd,file=udevadm,0',
'name=terminator,file=python3,500',
'name=unattended-upg,file=python3,0',
'name=Utility,file=firefox,500',
'name=zfs-auto-snaps,file=ruby,0',
'name=Web,file=firefox,500',
'name=WebExtensions,file=firefox,500',
'name=X,file=Xorg,0'
)
GROUP by short_name,
short_filename