mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2025-01-09 14:59:34 +00:00
81 lines
2.8 KiB
SQL
81 lines
2.8 KiB
SQL
SELECT p.name,
|
|
TRIM(SUBSTR(SPLIT(p.name, ":./ ", 0), 0, 15)) AS short_name,
|
|
TRIM(SUBSTR(SPLIT(f.filename, ":./ ", 0), 0, 15)) AS short_filename,
|
|
f.filename,
|
|
p.path,
|
|
p.cwd,
|
|
p.cmdline AS cmd,
|
|
p.parent AS parent_pid,
|
|
pp.path AS parent_path,
|
|
pp.name AS parent_name,
|
|
pp.cmdline AS parent_cmd,
|
|
pp.cwd AS parent_cwd,
|
|
pp.euid AS parent_euid,
|
|
hash.sha256 AS child_sha256,
|
|
phash.sha256 AS parent_sha256,
|
|
CONCAT(
|
|
"name=",
|
|
TRIM(SUBSTR(SPLIT(p.name, ":./ ", 0), 0, 15)),
|
|
",file=",
|
|
TRIM(SUBSTR(SPLIT(f.filename, ":./ ", 0), 0, 15)),
|
|
",",
|
|
MIN(p.uid, 500)
|
|
) AS exception_key
|
|
FROM processes p
|
|
LEFT JOIN file f ON p.path = f.path
|
|
LEFT JOIN processes pp ON p.parent = pp.pid
|
|
LEFT JOIN hash ON p.path = hash.path
|
|
LEFT JOIN hash AS phash ON pp.path = phash.path
|
|
WHERE short_filename != short_name
|
|
AND NOT cmd LIKE "/nix/store/%/bin/bash%" -- Serial masqueraders
|
|
AND NOT short_filename IN (
|
|
"bash",
|
|
"ruby",
|
|
"python",
|
|
"python3"
|
|
)
|
|
AND exception_key NOT IN (
|
|
"name=chrome-gnome-s,file=python3,500",
|
|
"name=code-oss,file=electron,500",
|
|
"name=firefox-wrappe,file=firefox,500",
|
|
"name=blueman-tray,file=python3,500",
|
|
"name=firewalld,file=python3,0",
|
|
"name=gjs,file=gjs-console,500",
|
|
"name=gnome-tweak-to,file=python3,500",
|
|
"name=gsettings-hel,file=gsettings-help,500",
|
|
"name=Isolated,file=firefox,500",
|
|
"name=sd_espeak-ng-m,file=sd_espeak-ng,500",
|
|
"name=mysqld,file=mariadbd,500",
|
|
"name=networkd-dispa,file=python3,0",
|
|
"name=MainThread,file=plugin-contain,500",
|
|
"name=nix-daemon,file=nix,0",
|
|
"name=npm,file=node,500",
|
|
"name=Chroot,file=firefox,500",
|
|
"name=exe,file=rootlessport,500",
|
|
"name=slic3r_main,file=prusa-slicer,500",
|
|
"name=osqueryi,file=osqueryd,500",
|
|
"name=blueman-applet,file=python3,500",
|
|
"name=phpstorm,file=dash,500",
|
|
"name=Privileged,file=firefox,500",
|
|
"name=RDD,file=firefox,500",
|
|
"name=sh,file=dash,0",
|
|
"name=zoom,file=ZoomLauncher,500",
|
|
"name=sh,file=dash,500",
|
|
"name=Socket,file=firefox,500",
|
|
"name=streamdeck,file=python3,500",
|
|
"name=systemd-udevd,file=udevadm,0",
|
|
"name=osqueryi,file=osqueryd,0",
|
|
"name=osqueryi,file=osqueryd,500",
|
|
"name=terminator,file=python3,500",
|
|
"name=unattended-upg,file=python3,0",
|
|
"name=Utility,file=firefox,500",
|
|
"name=zfs-auto-snaps,file=ruby,0",
|
|
"name=Web,file=firefox,500",
|
|
"name=WebExtensions,file=firefox,500",
|
|
"name=X,file=Xorg,0"
|
|
)
|
|
AND NOT (short_filename="systemd" AND short_name LIKE "(sd%")
|
|
AND NOT (short_filename LIKE "emacs%" AND short_name = "emacs")
|
|
|
|
GROUP by short_name,
|
|
short_filename |