RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2024-12-14 01:54:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #32 from tstromberg/osascript

Browse Source 
osascript: Add parent signing information
This commit is contained in:
Thomas Strömberg 2022-10-24 11:10:59 -04:00 committed by GitHub
commit d6e70ebcc3
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
detection/execution/unexpected-osascript-calls.sql
View File

@ -15,24 +15,25 @@ SELECT
p.euid, p.euid,
p.parent, p.parent,
p.syscall, p.syscall,
hash.sha256,
pp.path AS parent_path, pp.path AS parent_path,
pp.name AS parent_name, pp.name AS parent_name,
TRIM(p.cmdline) AS parent_cmd, TRIM(pp.cmdline) AS parent_cmd,
pp.euid AS parent_euid, pp.euid AS parent_euid,
phash.sha256 AS parent_sha256 hash.sha256 AS parent_sha256,
signature.identifier AS parent_identifier,
signature.authority AS parent_auth,
CONCAT(signature.identifier, ",", signature.authority, ",", SUBSTR(TRIM(p.cmdline), 0, 54)) AS exception_key
FROM FROM
uptime, uptime,
process_events p process_events p
LEFT JOIN processes pp ON p.parent = pp.pid LEFT JOIN processes pp ON p.parent = pp.pid
LEFT JOIN hash ON p.path = hash.path LEFT JOIN hash ON pp.path = hash.path
LEFT JOIN hash AS phash ON pp.path = phash.path LEFT JOIN signature ON pp.path = signature.path
WHERE WHERE
p.path = '/usr/bin/osascript' p.path = '/usr/bin/osascript'
AND p.time > (strftime('%s', 'now') -60) AND p.time > (strftime('%s', 'now') -60)
AND NOT cmd LIKE 'osascript -e set zoomStatus%' AND exception_key != 'com.vng.zalo,Developer ID Application: VNG ONLINE CO.,LTD (CVB6BX97VM),osascript -ss'
AND NOT cmd LIKE 'osascript openChrome.applescript http://127.0.0.1:%' AND cmd != 'osascript -e user locale of (get system info)'
AND NOT cmd IN ( AND NOT (
'osascript -e user locale of (get system info)', exception_key='org.python.python,,osascript' AND parent_cmd LIKE '% /opt/homebrew/bin/jupyter-notebook'
'osascript'
) )