osquery-defense-kit/process/high-disk-bytes-written.sql

44 lines
1.6 KiB
MySQL
Raw Normal View History

2022-09-02 14:56:04 +00:00
SELECT name,
path,
cmdline,
on_disk,
parent,
start_time,
disk_bytes_written,
cwd,
(strftime('%s', 'now') - start_time) AS age,
disk_bytes_written / (strftime('%s', 'now') - start_time) AS bytes_per_second
2022-08-31 18:34:42 +00:00
FROM processes
2022-09-02 16:56:31 +00:00
WHERE bytes_per_second > 2000000
2022-09-02 14:56:04 +00:00
AND age > 120
AND path NOT IN (
2022-09-02 16:56:31 +00:00
'/bin/bash',
'/usr/bin/bash',
2022-09-09 14:16:28 +00:00
'/usr/bin/zsh',
2022-09-02 16:56:31 +00:00
'/usr/bin/fish',
'/usr/bin/gnome-shell',
2022-09-02 14:56:04 +00:00
'/usr/lib/systemd/systemd-journald',
2022-09-07 02:08:17 +00:00
'/usr/libexec/sharingd',
2022-09-02 14:56:04 +00:00
'/usr/lib/systemd/systemd',
2022-09-02 16:56:31 +00:00
'/usr/libexec/coreduetd',
'/usr/libexec/coreduetd',
'/usr/libexec/packagekitd',
'/usr/libexec/rosetta/oahd',
2022-09-07 02:08:17 +00:00
'/usr/libexec/secd',
'/usr/bin/aptd',
2022-09-09 14:16:28 +00:00
'/usr/sbin/screencapture',
2022-09-10 11:24:17 +00:00
'/usr/lib64/thunderbird/thunderbird',
'/usr/bin/yay'
2022-09-02 14:56:04 +00:00
)
AND NOT (name LIKE "jbd%/dm-%" AND on_disk = -1)
AND NOT (name = 'bindfs' AND cmdline LIKE 'bindfs -f -o fsname=%')
AND NOT (name = 'btrfs-transaction' AND on_disk = -1)
2022-09-02 16:56:31 +00:00
AND NOT (name = 'kernel_task' AND path = '' AND parent IN (0, 1) AND on_disk = -1)
AND NOT (name = 'launchd' AND path = '/sbin/launchd' AND parent = 0)
AND NOT (name = 'logd' AND cmdline = '/usr/libexec/logd' AND parent = 1)
AND NOT name IN ('firefox', 'gopls', 'containerd', 'slack', 'chrome','goland', 'esbuild', 'slack')
2022-09-02 14:56:04 +00:00
AND path NOT LIKE '/Applications/%.app/Contents/%'
AND path NOT LIKE '/System/Applications/%'
2022-09-08 21:58:56 +00:00
AND path NOT LIKE '/System/Library/%'
2022-09-08 22:23:28 +00:00
AND path NOT LIKE '/home/%/.local/share/Steam'
AND path NOT LIKE '/nix/store/%/bin/%sh'