-- Programs who were recently added to disk, based on btime/ctime -- -- false-positives: -- * many -- -- tags: transient process state often -- platform: linux SELECT f.ctime, f.mtime, -- Child p0.pid AS p0_pid, p0.path AS p0_path, p0.name AS p0_name, p0.cmdline AS p0_cmd, p0.cwd AS p0_cwd, p0.cgroup_path AS p0_cgroup, p0.euid AS p0_euid, p0_hash.sha256 AS p0_sha256, -- Parent p0.parent AS p1_pid, p1.path AS p1_path, p1.name AS p1_name, p1.euid AS p1_euid, p1.cmdline AS p1_cmd, p1_hash.sha256 AS p1_sha256, -- Grandparent p1.parent AS p2_pid, p2.name AS p2_name, p2.path AS p2_path, p2.cmdline AS p2_cmd, p2_hash.sha256 AS p2_sha256 FROM processes p0 LEFT JOIN file f ON p0.path = f.path LEFT JOIN hash p0_hash ON p0.path = p0_hash.path LEFT JOIN processes p1 ON p0.parent = p1.pid LEFT JOIN hash p1_hash ON p1.path = p1_hash.path LEFT JOIN processes p2 ON p1.parent = p2.pid LEFT JOIN hash p2_hash ON p2.path = p2_hash.path WHERE p0.start_time > 0 AND f.ctime > 0 AND p0.start_time > (strftime('%s', 'now') - 7200) AND (p0.start_time - MAX(f.ctime, f.btime)) < 45 AND p0.start_time >= MAX(f.ctime, f.ctime) AND NOT f.directory IN ('/usr/lib/firefox', '/usr/local/kolide-k2/bin') -- Typically daemons or long-running desktop apps -- These are binaries that are known to get updated and subsequently executed -- -- What I would give for osquery to support binary signature verification on Linux AND NOT p0.path IN ( '', '/opt/google/chrome/chrome', '/usr/bin/packer', '/opt/google/chrome/chrome_crashpad_handler', '/opt/google/chrome/nacl_helper', '/usr/bin/gnome-software', '/opt/Lens/chrome_crashpad_handler', '/opt/Lens/lens', '/usr/lib/ibus/ibus-dconf', '/usr/bin/limactl', '/usr/lib/ibus/ibus-portal', '/usr/libexec/gstreamer-1.0/gst-plugin-scanner', '/usr/lib/ibus/ibus-engine-simple', '/usr/bin/faked', '/usr/bin/appstreamcli', '/opt/sublime_text/sublime_text', '/usr/lib/systemd/systemd-machined', '/usr/lib/upowerd', '/usr/bin/nvidia-persistenced', '/usr/bin/alacritty', '/usr/bin/dash', '/usr/bin/bash', '/usr/bin/rpmbuild', '/usr/bin/make', '/usr/bin/cargo', '/usr/bin/containerd', '/usr/bin/containerd-shim-runc-v2', '/usr/bin/docker', '/usr/bin/dockerd', '/usr/bin/docker-proxy', '/usr/bin/fusermount3', '/usr/bin/gedit', '/usr/bin/gjs-console', '/usr/bin/gnome-keyring-daemon', '/usr/bin/ibus-daemon', '/usr/bin/kbfsfuse', '/usr/bin/keybase', '/usr/bin/keybase-redirector', '/usr/bin/NetworkManager', '/usr/bin/nm-applet', '/usr/bin/obs', '/usr/bin/pavucontrol', '/usr/bin/pipewire', '/usr/bin/pipewire-pulse', '/usr/bin/python3.11', '/usr/bin/rpi-imager', '/usr/bin/snap', '/usr/bin/tailscaled', '/usr/bin/sshfs', '/usr/bin/udevadm', '/usr/bin/wireplumber', '/usr/bin/wpa_supplicant', '/usr/lib64/electron/electron', '/usr/lib64/firefox/firefox', '/usr/lib64/google-cloud-sdk/platform/bundledpythonunix/bin/python3', '/usr/lib64/thunderbird/thunderbird', '/usr/lib/at-spi2-registryd', '/usr/lib/at-spi-bus-launcher', '/usr/libexec/bluetooth/bluetoothd', '/usr/libexec/docker/docker-proxy', '/usr/libexec/fwupd/fwupd', '/usr/libexec/ibus-dconf', '/usr/libexec/ibus-engine-simple', '/usr/libexec/ibus-extension-gtk3', '/usr/libexec/ibus-portal', '/usr/lib/polkit-gnome/polkit-gnome-authentication-agent-1', '/usr/lib/systemd/systemd-hostnamed', '/usr/libexec/ibus-x11', '/usr/bin/hugo', '/usr/libexec/snapd/snapd', '/usr/libexec/sssd/sssd_kcm', '/usr/libexec/tracker-extract-3', '/usr/libexec/tracker-miner-fs-3', '/usr/lib/flatpak-session-helper', '/usr/lib/fwupd/fwupd', '/usr/lib/gdm', '/usr/bin/gnome-shell', '/usr/lib/gnome-shell-calendar-server', '/usr/lib/gdm-session-worker', '/usr/bin/sudo', '/usr/lib/gdm-x-session', '/usr/lib/google-cloud-sdk/platform/bundledpythonunix/bin/python3', '/usr/lib/libreoffice/program/oosplash', '/usr/lib/libreoffice/program/soffice.bin', '/usr/lib/polkit-1/polkitd', '/usr/lib/slack/chrome_crashpad_handler', '/usr/lib/slack/slack', '/usr/lib/snapd/snapd', '/usr/lib/systemd/systemd', '/bin/containerd-shim-runc-v2', '/bin/containerd', '/usr/lib/systemd/systemd-journald', '/usr/lib/systemd/systemd-logind', '/usr/lib/systemd/systemd-homed', '/usr/lib/systemd/systemd-oomd', '/usr/lib/systemd/systemd-resolved', '/usr/lib/systemd/systemd-timesyncd', '/usr/lib/systemd/systemd-userdbd', '/usr/lib/systemd/systemd-userwork', '/usr/sbin/sshd', '/usr/lib/tracker-extract-3', '/usr/bin/gitsign-credential-cache', '/usr/libexec/gnome-shell-calendar-server', '/usr/lib/x86_64-linux-gnu/obs-plugins/obs-browser-page', '/usr/sbin/semodule', '/usr/lib/xdg-desktop-portal-gtk', '/usr/libexec/accounts-daemon', '/usr/bin/gnome-calendar', '/usr/bin/ssh-agent', '/usr/lib/xf86-video-intel-backlight-helper', '/usr/local/bin/kind', '/usr/libexec/flatpak-system-helper', '/usr/bin/golangci-lint', '/usr/sbin/alsactl', '/usr/lib/docker/cli-plugins/docker-compose', '/usr/sbin/avahi-daemon', '/usr/sbin/chronyd', '/usr/sbin/cupsd', '/usr/sbin/ModemManager', '/usr/sbin/NetworkManager', '/usr/sbin/rngd', '/usr/sbin/tailscaled', '/usr/share/code/chrome_crashpad_handler', '/usr/share/code/code', '/usr/share/spotify-client/spotify', '/usr/share/teams/team' ) AND NOT p0.path LIKE '/home/%/bin/%' AND NOT p0.path LIKE '/home/%/.local/share/JetBrains/Toolbox/apps/%' AND NOT p0.path LIKE '/home/%/.local/share/nvim/mason/packages/%' AND NOT p0.path LIKE '/home/%/.cache/JetBrains/%/GoLand/___%' AND NOT p0.path LIKE '/home/%/.local/share/Steam/ubuntu%' AND NOT p0.path LIKE '/home/%/.rustup/toolchains/%/libexec/%' AND NOT p0.path LIKE '/home/%/jbr/lib/jcef_helper' AND NOT p0.path LIKE '/home/%/jbr/bin/java' AND NOT p0.path LIKE '/home/%/node_modules/.bin/%' AND NOT p0.path LIKE '/home/%/Projects/%' AND NOT p0.path LIKE '/home/%/terraform-provider-%' AND NOT p0.path LIKE '/home/%/%.test' AND NOT p0.path LIKE '/nix/store/%/bin/%' AND NOT p0.path LIKE '/nix/store/%/libexec/%' AND NOT p0.path LIKE '/opt/%' AND NOT p0.path LIKE '/tmp/go-build%' AND NOT p0.path LIKE '/tmp/terraform_%/terraform' AND NOT p0.path LIKE '/tmp/tmp0.%/%/bin/%' AND NOT p0.path LIKE '/usr/local/bin/%' AND NOT p0.path LIKE '/usr/local/Cellar/%' AND NOT p0.path LIKE '/usr/local/kolide-k2/bin/osqueryd-updates/%/osqueryd' AND NOT p0.path LIKE '/usr/local/kolide-k2/bin/launcher-updates/%/launcher' AND NOT p0.path LIKE '%/.vscode/extensions/%' AND NOT ( p0.name IN ('osqtool-x86_64', 'osqtool-arm64') AND p0.cmdline LIKE './%' ) AND NOT p1.path IN ('/usr/bin/gnome-shell') -- Filter out developers working on their own code AND NOT ( p0.path LIKE '/home/%' AND p0.uid > 499 AND f.ctime = f.mtime AND f.uid = p0.uid AND p0.cmdline LIKE './%' ) AND NOT ( p0.path LIKE '/tmp/%/osqtool-%' AND p0.uid > 499 AND f.ctime = f.mtime AND f.uid = p0.uid AND p0.cmdline LIKE './%' ) AND NOT ( p0.path LIKE '/home/%/.magefile/%' AND p0.uid > 499 AND f.ctime = f.mtime AND f.uid = p0.uid ) GROUP BY p0.pid