osquery-defense-kit/process/sketchy-fetcher.sql

62 lines
2.2 KiB
MySQL
Raw Normal View History

2022-09-09 14:16:28 +00:00
SELECT p.pid,
p.path,
p.name,
p.cmdline,
REGEX_MATCH(p.cmdline, '/(\d+\.\d+\.\d+\.\d+)[:/]', 1) AS remote_address,
REGEX_MATCH(p.cmdline, '/(:\d+\/)/', 1) AS remote_port,
2022-09-09 14:16:28 +00:00
p.cwd,
p.euid,
p.parent,
pp.path AS parent_path,
pp.name AS parent_name,
pp.cmdline AS parent_cmdline,
2022-09-14 00:46:04 +00:00
pp.euid AS parent_euid,
hash.sha256 AS parent_sha256
2022-09-09 14:16:28 +00:00
FROM processes p
2022-09-14 00:46:04 +00:00
LEFT JOIN processes pp ON p.parent = pp.pid
LEFT JOIN hash ON pp.path = hash.path
2022-09-09 14:16:28 +00:00
WHERE
2022-09-15 13:34:45 +00:00
-- NOTE: Sync remaining portion with sketchy-fetcher-events
(
INSTR(p.cmdline, 'wget ') > 0
OR INSTR(p.cmdline, 'curl ') > 0
) AND (
remote_address NOT IN ("", "127.0.0.1", "::1")
OR remote_port != ""
OR p.cmdline LIKE "%.onion%"
2022-09-15 13:34:45 +00:00
OR p.cmdline LIKE "%tor2web%"
OR p.cmdline LIKE "%aliyun%"
OR p.cmdline LIKE "%pastebin%"
OR p.cmdline LIKE "%curl %--user-agent%"
OR p.cmdline LIKE "%curl -k%"
OR p.cmdline LIKE "%curl%--insecure%"
OR p.cmdline LIKE "%wget %--user-agent%"
OR p.cmdline LIKE "%wget %--no-check-certificate%"
OR (p.cmdline LIKE "%wget %" AND p.euid < 500)
OR (p.cmdline LIKE "%curl %" AND p.euid < 500)
)
-- Exceptions for all calls
AND pp.name NOT IN ('makepkg') -- Exceptions for non-privileged calls
AND NOT (
p.euid > 500
AND (
p.cmdline LIKE "%--dump-header%"
2022-09-15 15:28:50 +00:00
OR p.cmdline LIKE "%/api/v%"
OR p.cmdline LIKE "%curl -X %"
OR p.cmdline LIKE "%go mod %"
OR p.cmdline LIKE "%application/json%"
OR p.cmdline LIKE "%grpcurl%"
2022-09-15 13:34:45 +00:00
OR p.cmdline LIKE "%Homebrew%"
OR p.cmdline LIKE "%If-None-Match%"
OR p.cmdline LIKE "%ctlog%"
OR p.cmdline LIKE "%.well-known/openid-configuration%"
OR p.cmdline LIKE "%/openid/v1/jwks%"
2022-09-16 18:21:42 +00:00
OR p.cmdline LIKE "%--progress-bar%"
2022-09-15 13:34:45 +00:00
OR parent_cmdline LIKE "%brew.rb%"
OR parent_cmdline LIKE "%brew.sh%"
2022-09-16 18:21:42 +00:00
OR p.cmdline LIKE "git %"
OR p.cmdline LIKE "%LICENSES/vendor/%"
OR p.cmdline LIKE "%localhost:%"
OR p.cmdline LIKE "%127.0.0.1:%"
2022-09-15 13:34:45 +00:00
)
)