osquery-defense-kit/process_events/sketchy-fetcher-events.sql

68 lines
2.4 KiB
SQL

-- Events version of sketchy-fetchers
-- Designed for execution every 5 minutes
SELECT p.pid,
p.path,
p.mode,
p.cwd,
p.euid,
p.parent,
p.syscall,
pp.path AS parent_path,
pp.name AS parent_name,
pp.cmdline AS parent_cmdline,
pp.euid AS parent_euid,
hash.sha256 AS parent_sha256
FROM process_events p
LEFT JOIN processes pp ON p.parent = pp.pid
LEFT JOIN hash ON pp.path = hash.path
WHERE (
p.cmdline LIKE "%.onion%"
OR p.cmdline LIKE "%tor2web%"
OR p.cmdline LIKE "%aliyun%"
OR p.cmdline LIKE "%pastebin%"
OR p.cmdline LIKE "%curl %/.%"
OR p.cmdline LIKE "%curl %.0%"
OR p.cmdline LIKE "%curl %.1%"
OR p.cmdline LIKE "%curl %.2%"
OR p.cmdline LIKE "%curl %.3%"
OR p.cmdline LIKE "%curl %.4%"
OR p.cmdline LIKE "%curl %.5%"
OR p.cmdline LIKE "%curl %.6%"
OR p.cmdline LIKE "%curl %.7%"
OR p.cmdline LIKE "%curl %.8%"
OR p.cmdline LIKE "%curl %.9%"
OR p.cmdline LIKE "%curl %:0%"
OR p.cmdline LIKE "%curl %:1%"
OR p.cmdline LIKE "%curl %:2%"
OR p.cmdline LIKE "%curl %:3%"
OR p.cmdline LIKE "%curl %:4%"
OR p.cmdline LIKE "%curl %:5%"
OR p.cmdline LIKE "%curl %:6%"
OR p.cmdline LIKE "%curl %:7%"
OR p.cmdline LIKE "%curl %:8%"
OR p.cmdline LIKE "%curl %:9%"
OR p.cmdline LIKE "%curl %--user-agent%"
OR p.cmdline LIKE "%curl -fsSL%"
OR p.cmdline LIKE "%curl -k%"
OR p.cmdline LIKE "%curl%--insecure%"
OR p.cmdline LIKE "%wget %/.%"
OR p.cmdline LIKE "%wget %.0%"
OR p.cmdline LIKE "%wget %.1%"
OR p.cmdline LIKE "%wget %.2%"
OR p.cmdline LIKE "%wget %.3%"
OR p.cmdline LIKE "%wget %.4%"
OR p.cmdline LIKE "%wget %.5%"
OR p.cmdline LIKE "%wget %.6%"
OR p.cmdline LIKE "%wget %.7%"
OR p.cmdline LIKE "%wget %.8%"
OR p.cmdline LIKE "%wget %.9%"
OR p.cmdline LIKE "%wget %--user-agent%"
OR p.cmdline LIKE "%wget %--no-check-certificate%"
)
AND p.cmdline NOT LIKE "%If-None-Match%"
AND p.cmdline NOT LIKE "%ctlog%"
AND p.cmdline NOT LIKE "%.well-known/openid-configuration%"
AND p.cmdline NOT LIKE "--progress-bar"
AND parent_name NOT IN ('makepkg')
AND parent_cmdline NOT LIKE "%brew.rb%"
AND parent_cmdline NOT LIKE "%brew.sh%"