mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2024-12-11 08:34:34 +00:00
26 lines
509 B
SQL
26 lines
509 B
SQL
-- Find unexpected use of raw sockets in executables, sometimes used for C&C communications
|
|
--
|
|
-- false positives:
|
|
-- * operating-system network managers
|
|
--
|
|
-- tags: transient process state
|
|
-- platform: posix
|
|
SELECT
|
|
pop.pid,
|
|
p.path,
|
|
p.cmdline,
|
|
p.name,
|
|
hash.sha256
|
|
FROM
|
|
process_open_sockets pop
|
|
JOIN processes p ON pop.pid = p.pid
|
|
JOIN hash ON p.path = hash.path
|
|
WHERE
|
|
family = 17 -- PF_PACKET
|
|
AND name NOT IN (
|
|
'wpa_supplicant',
|
|
'NetworkManager',
|
|
'dhcpcd',
|
|
'tcpdump'
|
|
)
|