RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-02-16 09:27:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Performance tuning, mark some Linux queries as 'extra'

Browse Source
This commit is contained in:
Thomas Stromberg 2024-03-15 19:06:16 -04:00
parent 9342485881
commit 3447f95d9e
Failed to extract signature
12 changed files with 15 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Makefile
View File

@ -9,16 +9,16 @@ out/osqtool-$(ARCH)-$(OSQTOOL_VERSION):
mv out/osqtool out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) mv out/osqtool out/osqtool-$(ARCH)-$(OSQTOOL_VERSION)
out/detection.conf: out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) $(wildcard detection/*.sql) out/detection.conf: out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) $(wildcard detection/*.sql)
./out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) --max-query-duration=8s --verify -output out/detection.conf pack detection ./out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) --max-query-duration=8s --verify --exclude-tags=disabled,disabled-privacy,extra --output out/detection.conf pack detection
out/policy.conf: out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) $(wildcard policy/*.sql) out/policy.conf: out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) $(wildcard policy/*.sql)
./out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) --max-query-duration=8s --verify --output out/policy.conf pack policy/ ./out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) --max-query-duration=8s --exclude-tags=disabled,disabled-privacy,extra o --verify --output out/policy.conf pack policy/
out/vulnerabilities.conf: out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) $(wildcard vulnerabilities/*.sql) out/vulnerabilities.conf: out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) $(wildcard vulnerabilities/*.sql)
./out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) --max-query-duration=8s --output out/vulnerabilities.conf pack vulnerabilities/ ./out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) --max-query-duration=8s --exclude-tags=disabled,disabled-privacy,extra --output out/vulnerabilities.conf pack vulnerabilities/
out/incident-response.conf: out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) $(wildcard incident_response/*.sql) out/incident-response.conf: out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) $(wildcard incident_response/*.sql)
./out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) --max-query-duration=8s --exclude-tags=disabled,disabled-privacy --output out/incident-response.conf pack incident_response/ ./out/osqtool-$(ARCH)-$(OSQTOOL_VERSION) --max-query-duration=8s --exclude-tags=disabled,disabled-privacy,extra --output out/incident-response.conf pack incident_response/
out/osquery.conf: out/osquery.conf:
cat osquery.conf | sed s/"out\/"/""/g > out/osquery.conf cat osquery.conf | sed s/"out\/"/""/g > out/osquery.conf

2
detection/c2/unexpected-icmp-socket-events.sql
View File

@ -4,7 +4,7 @@
-- *https://attack.mitre.org/techniques/T1095/ (C2: Non-Application Layer Protocol) -- *https://attack.mitre.org/techniques/T1095/ (C2: Non-Application Layer Protocol)
-- --
-- interval: 300 -- interval: 300
-- tags: transient events net -- tags: transient events net extra
SELECT SELECT
se.*, se.*,
p.path, p.path,

2
detection/c2/unexpected-icmp-socket.sql
View File

@ -3,7 +3,7 @@
-- references: -- references:
-- *https://attack.mitre.org/techniques/T1095/ (C2: Non-Application Layer Protocol) -- *https://attack.mitre.org/techniques/T1095/ (C2: Non-Application Layer Protocol)
-- --
-- tags: transient state net often -- tags: transient state net extra
SELECT SELECT
pop.pid AS p0_pid, pop.pid AS p0_pid,
pop.socket, pop.socket,

2
detection/c2/unexpected-talker-events.sql
View File

@ -3,7 +3,7 @@
-- references: -- references:
-- * https://attack.mitre.org/techniques/T1071/ (C&C, Application Layer Protocol) -- * https://attack.mitre.org/techniques/T1071/ (C&C, Application Layer Protocol)
-- --
-- tags: transient state net -- tags: transient state net extra
-- interval: 601 -- interval: 601
-- platform: posix -- platform: posix
SELECT SELECT

2
detection/evasion/hidden-cwd-events-linux.sql
View File

@ -9,7 +9,7 @@
-- references: -- references:
-- * https://attack.mitre.org/techniques/T1564/001/ (Hide Artifacts: Hidden Files and Directories) -- * https://attack.mitre.org/techniques/T1564/001/ (Hide Artifacts: Hidden Files and Directories)
-- --
-- tags: transient -- tags: transient extra
-- platform: linux -- platform: linux
-- interval: 600 -- interval: 600
SELECT SELECT

2
detection/execution/exotic-command-events-linux.sql
View File

@ -6,7 +6,7 @@
-- false positives: -- false positives:
-- * possible, but none known -- * possible, but none known
-- --
-- tags: transient process events -- tags: transient process events extra
-- platform: linux -- platform: linux
-- interval: 600 -- interval: 600
SELECT -- Child SELECT -- Child

2
detection/execution/yara-unexpected-upx-process.sql
View File

@ -1,7 +1,7 @@
-- Currently running UPX executable -- Currently running UPX executable
-- --
-- tags: persistent -- tags: persistent
-- interval: 3600 -- interval: 7199
-- platform: posix -- platform: posix
SELECT SELECT
yara.*, yara.*,

2
detection/initial_access/yara-recently-downloaded-miner.sql
View File

@ -1,4 +1,4 @@
-- Recently downloaded UPX file -- tags: volume filesystem seldom
SELECT SELECT
file.path, file.path,
file.size, file.size,

2
detection/initial_access/yara-recently-downloaded-ransom.sql
View File

@ -1,4 +1,4 @@
-- Recently downloaded UPX file -- tags: volume filesystem seldom
SELECT SELECT
file.path, file.path,
file.size, file.size,

2
detection/initial_access/yara-recently-downloaded-rust-http-exec.sql
View File

@ -1,4 +1,4 @@
-- Recently downloaded cryptexec program -- tags: volume filesystem seldom
SELECT SELECT
file.path, file.path,
file.size, file.size,

2
detection/initial_access/yara-recently-downloaded-stealer.sql
View File

@ -1,4 +1,4 @@
-- Recently downloaded Stealer -- tags: volume filesystem seldom
SELECT SELECT
file.path, file.path,
file.size, file.size,

2
detection/initial_access/yara-recently-downloaded-upx.sql
View File

@ -1,4 +1,4 @@
-- Recently downloaded UPX file -- tags: volume filesystem seldom
SELECT SELECT
file.path, file.path,
file.size, file.size,