mirror of
https://github.com/chainguard-dev/osquery-defense-kit
synced 2025-02-10 14:37:03 +00:00
152 lines
6.8 KiB
SQL
152 lines
6.8 KiB
SQL
-- Programs who were recently written to disk, based on btime (macOS) or ctime (Linux)
|
|
--
|
|
-- false-positives:
|
|
-- * many
|
|
--
|
|
-- tags: transient process state often
|
|
-- platform: posix
|
|
SELECT
|
|
p.pid,
|
|
p.path,
|
|
p.name,
|
|
p.cmdline,
|
|
p.cwd,
|
|
p.euid,
|
|
p.parent,
|
|
f.directory,
|
|
f.ctime,
|
|
f.btime,
|
|
f.mtime,
|
|
p.start_time,
|
|
pp.path AS parent_path,
|
|
pp.name AS parent_name,
|
|
pp.cmdline AS parent_cmdline,
|
|
pp.cwd AS parent_cwd,
|
|
pp.euid AS parent_euid,
|
|
ch.sha256 AS child_sha256,
|
|
ph.sha256 AS parent_sha256
|
|
FROM
|
|
processes p
|
|
LEFT JOIN file f ON p.path = f.path
|
|
LEFT JOIN processes pp ON p.parent = pp.pid
|
|
LEFT JOIN hash AS ch ON p.path = ch.path
|
|
LEFT JOIN hash AS ph ON pp.path = ph.path
|
|
WHERE
|
|
p.start_time > 0
|
|
AND f.ctime > 0 -- Only process programs that had an inode modification within the last 3 minutes
|
|
AND (p.start_time - MAX(f.ctime, f.btime)) < 180
|
|
AND p.start_time >= MAX(f.ctime, f.ctime)
|
|
AND NOT f.directory IN (
|
|
'/Applications/Firefox.app/Contents/MacOS/plugin-container.app/Contents/MacOS',
|
|
'/Applications/Grammarly Desktop.app/Contents/MacOS',
|
|
'/Applications/Opal.app/Contents/Library/LaunchServices',
|
|
'/Applications/Opal.app/Contents/MacOS',
|
|
'/Applications/Opal.app/Contents/XPCServices/OpalCameraDeviceService.xpc/Contents/MacOS',
|
|
'/Applications/Signal.app/Contents/Frameworks/Signal Helper.app/Contents/MacOS',
|
|
'/Applications/Signal.app/Contents/Frameworks/Signal Helper (GPU).app/Contents/MacOS',
|
|
'/Applications/Signal.app/Contents/Frameworks/Signal Helper (Renderer).app/Contents/MacOS',
|
|
'/Applications/Signal.app/Contents/MacOS',
|
|
'/Applications/Slack.app/Contents/Frameworks/Slack Helper.app/Contents/MacOS',
|
|
'/Applications/Slack.app/Contents/Frameworks/Slack Helper (GPU).app/Contents/MacOS',
|
|
'/Applications/Slack.app/Contents/Frameworks/Slack Helper (Renderer).app/Contents/MacOS',
|
|
'/Applications/Slack.app/Contents/MacOS',
|
|
'/Applications/Spotify.app/Contents/Frameworks/Spotify Helper.app/Contents/MacOS',
|
|
'/Applications/Spotify.app/Contents/Frameworks/Spotify Helper (GPU).app/Contents/MacOS',
|
|
'/Applications/Spotify.app/Contents/Frameworks/Spotify Helper (Renderer).app/Contents/MacOS',
|
|
'/Applications/Spotify.app/Contents/MacOS',
|
|
'/Applications/Stream Deck.app/Contents/Frameworks/QtWebEngineCore.framework/Versions/5/Helpers/QtWebEngineProcess.app/Contents/MacOS',
|
|
'/Applications/Stream Deck.app/Contents/MacOS',
|
|
'/Applications/Tailscale.app/Contents/MacOS',
|
|
'/usr/lib/firefox',
|
|
'/Applications/Tailscale.app/Contents/PlugIns/IPNExtension.appex/Contents/MacOS',
|
|
'/Applications/Todoist.app/Contents/Frameworks/Todoist Helper.app/Contents/MacOS',
|
|
'/Applications/Todoist.app/Contents/Frameworks/Todoist Helper (GPU).app/Contents/MacOS',
|
|
'/Applications/Todoist.app/Contents/Frameworks/Todoist Helper (Renderer).app/Contents/MacOS',
|
|
'/Applications/Todoist.app/Contents/MacOS',
|
|
'/Library/Apple/System/Library/CoreServices/XProtect.app/Contents/MacOS',
|
|
'/Library/Apple/System/Library/PrivateFrameworks/MobileDevice.framework/Versions/A/Resources',
|
|
'/Library/Application Support/Adobe/AdobeGCClient',
|
|
'/Library/CoreMediaIO/Plug-Ins/DAL/OpalVirtualCamera.plugin/Contents/Resources',
|
|
'/Library/Developer/CommandLineTools/usr/bin',
|
|
'/Library/Printers/Brother/Utilities/Server/LOGINserver.app/Contents/MacOS',
|
|
'/Library/Printers/Brother/Utilities/Server/NETserver.app/Contents/MacOS',
|
|
'/Library/Printers/Brother/Utilities/Server/USBAppControl.app/Contents/MacOS',
|
|
'/Library/Printers/Brother/Utilities/Server/USBserver.app/Contents/MacOS',
|
|
'/Library/Printers/Brother/Utilities/Server/WorkflowAppControl.app/Contents/MacOS',
|
|
'/usr/local/kolide-k2/bin'
|
|
)
|
|
-- Typically daemons or long-running desktop apps
|
|
AND NOT p.path IN (
|
|
'',
|
|
'/Library/DropboxHelperTools/Dropbox_u501/dbkextd',
|
|
'/Library/PrivilegedHelperTools/com.adobe.acc.installer.v2',
|
|
'/Library/PrivilegedHelperTools/com.docker.vmnetd',
|
|
'/opt/google/chrome/chrome',
|
|
'/usr/bin/containerd',
|
|
'/usr/bin/dockerd',
|
|
'/usr/bin/obs',
|
|
'/usr/bin/udevadm',
|
|
'/usr/bin/pipewire',
|
|
'/usr/lib/at-spi2-registryd',
|
|
'/usr/lib/at-spi-bus-launcher',
|
|
'/usr/libexec/fwupd/fwupd',
|
|
'/usr/libexec/sssd/sssd_kcm',
|
|
'/usr/lib/fwupd/fwupd',
|
|
'/usr/lib/slack/chrome_crashpad_handler',
|
|
'/usr/lib/slack/slack',
|
|
'/usr/lib/systemd/systemd-journald',
|
|
'/usr/lib/systemd/systemd-oomd',
|
|
'/usr/lib/systemd/systemd-resolved',
|
|
'/usr/lib/systemd/systemd-timesyncd',
|
|
'/usr/lib/x86_64-linux-gnu/obs-plugins/obs-browser-page',
|
|
'/usr/lib/xf86-video-intel-backlight-helper',
|
|
'/usr/sbin/cupsd',
|
|
'/usr/sbin/tailscaled'
|
|
)
|
|
AND NOT p.path LIKE '/Applications/%.app/%'
|
|
AND NOT p.path LIKE '%-go-build%'
|
|
AND NOT p.path LIKE '/home/%/bin/%'
|
|
AND NOT p.path LIKE '/home/%/terraform-provider-%'
|
|
AND NOT p.path LIKE '/home/%/%.test'
|
|
AND NOT p.path LIKE '/Library/Apple/System/%'
|
|
AND NOT p.path LIKE '/Library/Application Support/Adobe/Adobe Desktop Common/%'
|
|
AND NOT p.path LIKE '%/Library/Application Support/com.elgato.StreamDeck%' -- Known parent processes, typically GUI shells and updaters
|
|
AND NOT p.path LIKE '/Library/Application Support/Logitech.localized/%'
|
|
AND NOT p.path LIKE '/nix/store/%/bin/%'
|
|
AND NOT p.path LIKE '/opt/homebrew/bin/%'
|
|
AND NOT p.path LIKE '/opt/homebrew/Cellar/%'
|
|
AND NOT p.path LIKE '/private/tmp/%/Creative Cloud Installer.app/Contents/MacOS/Install'
|
|
AND NOT p.path LIKE '/private/tmp/go-build%'
|
|
AND NOT p.path LIKE '/private/tmp/nix-build-%'
|
|
AND NOT p.path LIKE '/private/var/db/com.apple.xpc.roleaccountd.staging/%'
|
|
AND NOT p.path LIKE '/private/var/folders/%/bin/%'
|
|
AND NOT p.path LIKE '/private/var/folders/%/go-build%'
|
|
AND NOT p.path LIKE '/private/var/folders/%/GoLand/%'
|
|
AND NOT p.path LIKE '/private/var/folders/%/T/pulumi-go.%'
|
|
AND NOT p.path LIKE '/Users/%/bin/%'
|
|
AND NOT p.path LIKE '/Users/%/code/%'
|
|
AND NOT p.path LIKE '/Users/%/Library/Application Support/%/Contents/MacOS/%'
|
|
AND NOT p.path LIKE '/Users/%/Library/Application Support/iTerm2/iTermServer-%'
|
|
AND NOT p.path LIKE '/Users/%/Library/Caches/%/Contents/MacOS/%'
|
|
AND NOT p.path LIKE '/Users/%/Library/Google/%.bundle/Contents/Helpers/%'
|
|
AND NOT p.path LIKE '/Users/%/Library/Mobile Documents/%/Contents/Frameworks%'
|
|
AND NOT p.path LIKE '/Users/%/terraform-provider-%'
|
|
AND NOT p.path LIKE '/Users/%/%.test'
|
|
AND NOT p.path LIKE '/usr/local/bin/%'
|
|
AND NOT p.path LIKE '/usr/local/Cellar/%'
|
|
AND NOT p.path LIKE '/usr/local/kolide-k2/bin/osqueryd-updates/%/osqueryd'
|
|
AND NOT p.path LIKE '%/.vscode/extensions/%'
|
|
AND NOT pp.path IN ('/usr/bin/gnome-shell') -- Filter out developers working on their own code
|
|
AND NOT (
|
|
(
|
|
p.path LIKE '/Users/%'
|
|
OR p.path LIKE '/home/%'
|
|
)
|
|
AND p.uid > 499
|
|
AND f.ctime = f.mtime
|
|
AND f.uid = p.uid
|
|
AND p.cmdline LIKE './%'
|
|
)
|
|
GROUP BY
|
|
p.pid
|