osquery-defense-kit/fs/unexpected-hidden-system-fo...

87 lines
2.3 KiB
SQL

SELECT
file.path,
uid,
gid,
mode,
mtime,
ctime,
type,
size,
hash.sha256,
magic.data
FROM
file
LEFT JOIN hash ON file.path = hash.path
LEFT JOIN magic ON file.path = magic.path
WHERE
(
file.path LIKE '/lib/.%'
OR file.path LIKE '/.%'
OR file.path LIKE '/bin/%/.%'
OR file.path LIKE '/lib/%/.%'
OR file.path LIKE '/libexec/.%'
OR file.path LIKE '/Library/.%'
OR file.path LIKE '/sbin/.%'
OR file.path LIKE '/sbin/%/.%'
OR file.path LIKE '/tmp/.%'
OR file.path LIKE '/usr/bin/.%'
OR file.path LIKE '/usr/lib/.%'
OR file.path LIKE '/usr/lib/%/.%'
OR file.path LIKE '/usr/libexec/.%'
OR file.path LIKE '/usr/local/bin/.%'
OR file.path LIKE '/usr/local/lib/.%'
OR file.path LIKE '/usr/local/lib/.%'
OR file.path LIKE '/usr/local/libexec/.%'
OR file.path LIKE '/usr/local/sbin/.%'
OR file.path LIKE '/usr/sbin/.%'
OR file.path LIKE '/var/.%'
OR file.path LIKE '/var/lib/.%'
OR file.path LIKE '/var/tmp/.%'
OR file.path LIKE '/dev/.%'
)
-- Avoid mentioning extremely temporary files
AND strftime('%s', 'now') - file.ctime > 20
AND file.path NOT IN (
'/.autorelabel',
'/.file',
'/.vol/',
'/.VolumeIcon.icns',
'/dev/.mdadm/',
'/tmp/._contentbarrier_installed',
'/tmp/../',
'/tmp/./',
'/tmp/.%.lock',
'/tmp/.com.apple.dt.CommandLineTools.installondemand.in-progress',
'/tmp/.dotnet/',
'/tmp/.font-unix/',
'/tmp/.ICE-unix/',
'/tmp/.Test-unix/',
'/tmp/.X0-lock',
'/tmp/.X1-lock',
'/tmp/.X11-unix/',
'/tmp/.XIM-unix/',
'/var/.ntw_cache',
'/var/.Parallels_swap/',
'/var/.pwd_cache'
)
AND file.path NOT LIKE '/tmp/.#%'
AND file.path NOT LIKE '/tmp/.com.google.Chrome.%'
AND file.path NOT LIKE '/tmp/.org.chromium.Chromium%'
AND file.path NOT LIKE '/tmp/.X1%-lock'
AND file.path NOT LIKE '/usr/local/%/.keepme'
AND file.path NOT LIKE '%/../'
AND file.path NOT LIKE '%/./'
AND file.path NOT LIKE '%/.build-id/'
AND file.path NOT LIKE '%/.dwz/'
AND file.path NOT LIKE '%/.updated'
AND file.path NOT LIKE '/%bin/bootstrapping/.default_components'
AND file.path NOT LIKE '%/google-cloud-sdk/.install/'
AND file.path NOT LIKE '/tmp/.%.gcode'
AND NOT (
type == 'regular'
AND (
filename LIKE "%.swp"
OR size < 2
)
)