osquery-defense-kit/startup/unexpected-systemd_units.sql

618 lines
24 KiB
SQL

-- TODO: Include augeas k/v pairs?
SELECT active_state, description, fragment_path, sub_state, hash.sha256, file.mtime, file.size
FROM systemd_units
LEFT JOIN hash ON systemd_units.fragment_path = hash.path
LEFT JOIN file ON systemd_units.fragment_path = file.path
WHERE active_state != "inactive"
AND sub_state != "plugged"
AND sub_state != "mounted"
AND fragment_path != ""
AND NOT (
(
fragment_path LIKE '/lib/systemd/system/%'
OR fragment_path LIKE '/usr/lib/systemd/system/%'
OR fragment_path LIKE "/etc/systemd/system/%"
OR fragment_path LIKE "/run/systemd/generator/%"
OR fragment_path LIKE "/run/systemd/generator.late/%.service"
OR fragment_path LIKE "/run/systemd/transient/%"
)
AND (
id IN (
'abrt-journal-core.service',
'abrt-oops.service',
'blk-availability.service',
'blockdev@.target',
'blockdev@dev-mapper-cryptoswap.target',
'bluetooth-mesh.service',
'bluetooth.service',
'bluetooth.target',
'bolt.service',
'boot-complete.target',
'brltty-device@.service',
'brltty@.service',
'btrfs-scrub@.service',
'btrfs-scrub@.timer',
'canberra-system-bootup.service',
'canberra-system-shutdown-reboot.service',
'canberra-system-shutdown.service',
'chronyd.service',
'clamav-clamonacc.service',
'clamav-daemon.service',
'clamav-daemon.socket',
'clamav-freshclam.service',
'colord.service',
'console-getty.service',
'console-setup.service',
'container-getty@.service',
'containerd.service',
'cron.service',
'cronie.service',
'cryptsetup-pre.target',
'cryptsetup.target',
'ctrl-alt-del.target',
'cups-browsed.service',
'cups.path',
'cups.service',
'cups.socket',
'daxdev-reconfigure@.service',
'dbus-broker.service',
'dbus-org.freedesktop.hostname1.service',
'dbus-org.freedesktop.import1.service',
'dbus-org.freedesktop.locale1.service',
'dbus-org.freedesktop.login1.service',
'dbus-org.freedesktop.machine1.service',
'dbus-org.freedesktop.portable1.service',
'dbus-org.freedesktop.timedate1.service',
'dbus.service',
'dbus.socket',
'debug-shell.service',
'default.target',
'dev-mapper-cryptoswap.swap',
'dhclient@.service',
'dhcpcd.service',
'display-manager.service',
'dkms.service',
'dm-event.service',
'dm-event.socket',
'dmraid.service',
'dnf-makecache.timer',
'dnsmasq.service',
'docker.service',
'docker.socket',
'dpkg-db-backup.timer',
'dracut-shutdown.service',
'drkonqi-coredump-processor@.service',
'e2scrub_all.service',
'e2scrub_all.timer',
'e2scrub_fail@.service',
'e2scrub_reap.service',
'e2scrub@.service',
'ead.service',
'emergency.service',
'emergency.target',
'exit.target',
'factory-reset.target',
'fancontrol.service',
'final.target',
'firewall.service',
'firewalld.service',
'first-boot-complete.target',
'flatpak-system-helper.service',
'fprintd.service',
'fstrim.service',
'fstrim.timer',
'ftpd.service',
'fwupd-offline-update.service',
'fwupd-refresh.service',
'fwupd-refresh.timer',
'fwupd.service',
'gdm.service',
'geoclue.service',
'getty-pre.target',
'getty.target',
'getty@.service',
'git-daemon.socket',
'git-daemon@.service',
'glances.service',
'gpm.service',
'graphical.target',
'gssproxy.service',
'halt.target',
'haveged-once.service',
'haveged.service',
'healthd.service',
'hibernate.target',
'httpd.service',
'hybrid-sleep.target',
'iio-sensor-proxy.service',
'import-state.service',
'initrd-cleanup.service',
'initrd-fs.target',
'initrd-parse-etc.service',
'initrd-root-device.target',
'initrd-root-fs.target',
'initrd-switch-root.service',
'initrd-switch-root.target',
'initrd-udevadm-cleanup-db.service',
'initrd-usr-fs.target',
'initrd.target',
'integritysetup-pre.target',
'integritysetup.target',
'ip6tables.service',
'iptables.service',
'irqbalance.service',
'iscsid.socket',
'iscsiuio.socket',
'iwd.service',
'kerneloops.service',
'kexec.target',
'keyboard-setup.service',
'kmod-static-nodes.service',
'kolide-launcher.service',
'krb5-kadmind.service',
'krb5-kdc.service',
'krb5-kpropd.service',
'krb5-kpropd.socket',
'krb5-kpropd@.service',
'launcher.kolide-k2.service',
'ldconfig.service',
'libvirt-guests.service',
'libvirtd-admin.socket',
'libvirtd-ro.socket',
'libvirtd-tcp.socket',
'libvirtd-tls.socket',
'libvirtd.service',
'libvirtd.socket',
'lightdm.service',
'livesys-late.service',
'livesys.service',
'lm_sensors.service',
'local-fs-pre.target',
'local-fs.target',
'logrotate-checkconf.service',
'logrotate.service',
'logrotate.timer',
'low-memory-monitor.service',
'lvm2-lvmpolld.service',
'lvm2-lvmpolld.socket',
'lvm2-monitor.service',
'lvm2.service',
'machine.slice',
'machines.target',
'man-db.service',
'man-db.timer',
'mariadb-extra.socket',
'mariadb-extra@.socket',
'mariadb.service',
'mariadb.socket',
'mariadb@.service',
'mariadb@.socket',
'mcelog.service',
'mdadm-grow-continue@.service',
'mdadm-last-resort@.service',
'mdadm-last-resort@.timer',
'mdcheck_continue.service',
'mdcheck_continue.timer',
'mdcheck_start.service',
'mdcheck_start.timer',
'mdmon@.service',
'mdmonitor-oneshot.service',
'mdmonitor-oneshot.timer',
'mdmonitor.service',
'mkinitcpio-generate-shutdown-ramfs.service',
'ModemManager.service',
'modprobe@.service',
'modprobe@chromeos_pstore.service',
'modprobe@efi_pstore.service',
'modprobe@mtdpstore.service',
'modprobe@pstore_blk.service',
'modprobe@pstore_zone.service',
'modprobe@ramoops.service',
'motd-news.timer',
'mount-pstore.service',
'multi-user.target',
'multipathd.service',
'multipathd.socket',
'mysql.service',
'mysqld.service',
'named.service',
'nbd.service',
'nbd@.service',
'ndctl-monitor.service',
'netctl-auto@.service',
'netctl-ifplugd@.service',
'netctl-sleep.service',
'netctl-wait-online.service',
'netctl.service',
'netctl@.service',
'network-interfaces.target',
'network-local-commands.service',
'network-online.target',
'network-pre.target',
'network-setup.service',
'network.target',
'networkd-dispatcher.service',
'NetworkManager-dispatcher.service',
'NetworkManager-wait-online.service',
'NetworkManager.service',
'nfs-blkmap.service',
'nfs-client.target',
'nfs-idmapd.service',
'nfs-mountd.service',
'nfs-server.service',
'nfs-utils.service',
'nfsdcld.service',
'nfsv4-exportd.service',
'nfsv4-server.service',
'nginx.service',
'ninfod.service',
'nix-daemon.service',
'nix-daemon.socket',
'nix-gc.timer',
'nm-priv-helper.service',
'nmb.service',
'nscd.service',
'nss-lookup.target',
'nss-user-lookup.target',
'ntpd.service',
'ntpdate.service',
'nvidia-persistenced.service',
'openvpn-client@.service',
'openvpn-server@.service',
'openvpn.service',
'ostree-boot-complete.service',
'ostree-finalize-staged.service',
'ostree-prepare-root.service',
'ostree-remount.service',
'paccache.service',
'paccache.timer',
'packagekit.service',
'pacman-filesdb-refresh.service',
'pacman-filesdb-refresh.timer',
'pam_namespace.service',
'paths.target',
'pcscd.service',
'pcscd.socket',
'phpsessionclean.timer',
'pkgfile-update.service',
'pkgfile-update.timer',
'plocate-updatedb.timer',
'plymouth-quit-wait.service',
'plymouth-read-write.service',
'plymouth-start.service',
'polkit.service',
'power-profiles-daemon.service',
'poweroff.target',
'ppp@.service',
'printer.target',
'proc-sys-fs-binfmt_misc.automount',
'qemu-pr-helper.service',
'qemu-pr-helper.socket',
'qemu-kvm.service',
'quotaon.service',
'raid-check.timer',
'rarpd@.service',
'rdisc.service',
'rdnssd@.service',
'reboot.target',
'reflector.service',
'reflector.timer',
'reload-systemd-vconsole-setup.service',
'remote-cryptsetup.target',
'remote-fs-pre.target',
'remote-fs.target',
'remote-veritysetup.target',
'rescue.service',
'rescue.target',
'resolvconf.service',
'rfkill-block@.service',
'rfkill-unblock@.service',
'rlogin.socket',
'rlogin@.service',
'rpc_pipefs.target',
'rpc-gssd.service',
'rpc-statd-notify.service',
'rpc-statd.service',
'rpcbind.service',
'rpcbind.socket',
'rpcbind.target',
'rsh.socket',
'rsh@.service',
'rsyncd.service',
'rsyncd.socket',
'rsyncd@.service',
'rsyslog.service',
'rtkit-daemon.service',
'samba.service',
'saned.socket',
'saned@.service',
'sddm.service',
'sensord.service',
'sentinelone.service',
'serial-getty@.service',
'setvtrgb.service',
'shadow.service',
'shadow.timer',
'shutdown.target',
'sigpwr.target',
'sleep.target',
'slices.target',
'smartcard.target',
'smartd.service',
'smb.service',
'snapd.apparmor.service',
'snapd.seeded.service',
'snapd.service',
'snapd.socket',
'snmpd.service',
'snmptrapd.service',
'sockets.target',
'sound.target',
'speech-dispatcherd.service',
'spice-vdagentd.service',
'spice-vdagentd.socket',
'spice-webdavd.service',
'sshd.service',
'sshdgenkeys.service',
'sssd-kcm.service',
'sssd-kcm.socket',
'suspend-then-hibernate.target',
'suspend.target',
'swap.target',
'switcheroo-control.service',
'sysinit.target',
'syslog.socket',
'sysprof2.service',
'sysprof3.service',
'sysstat-collect.timer',
'sysstat-summary.timer',
'sysstat.service',
'system-update-cleanup.service',
'system-update-pre.target',
'system-update.target',
'systemd-ask-password-console.path',
'systemd-ask-password-console.service',
'systemd-ask-password-plymouth.path',
'systemd-ask-password-wall.path',
'systemd-ask-password-wall.service',
'systemd-backlight@.service',
'systemd-backlight@backlight:intel_backlight.service',
'systemd-backlight@leds:dell::kbd_backlight.service',
'systemd-backlight@leds:tpacpi::kbd_backlight.service',
'systemd-binfmt.service',
'systemd-bless-boot.service',
'systemd-boot-check-no-failures.service',
'systemd-boot-system-token.service',
'systemd-boot-update.service',
'systemd-coredump.socket',
'systemd-coredump@.service',
'systemd-cryptsetup@cryptoswap.service',
'systemd-exit.service',
'systemd-firstboot.service',
'systemd-fsck-root.service',
'systemd-fsck@.service',
'systemd-fsckd.socket',
'systemd-halt.service',
'systemd-hibernate-resume@.service',
'systemd-hibernate.service',
'systemd-homed-activate.service',
'systemd-homed.service',
'systemd-hostnamed.service',
'systemd-hwdb-update.service',
'systemd-hybrid-sleep.service',
'systemd-importd.service',
'systemd-initctl.socket',
'systemd-journal-catalog-update.service',
'systemd-journal-flush.service',
'systemd-journal-gatewayd.service',
'systemd-journal-gatewayd.socket',
'systemd-journal-remote.service',
'systemd-journal-remote.socket',
'systemd-journal-upload.service',
'systemd-journald-audit.socket',
'systemd-journald-dev-log.socket',
'systemd-journald-varlink@.socket',
'systemd-journald.service',
'systemd-journald.socket',
'systemd-journald@.service',
'systemd-journald@.socket',
'systemd-kexec.service',
'systemd-localed.service',
'systemd-logind.service',
'systemd-machine-id-commit.service',
'systemd-machined.service',
'systemd-modules-load.service',
'systemd-network-generator.service',
'systemd-networkd-wait-online.service',
'systemd-networkd-wait-online@.service',
'systemd-networkd.service',
'systemd-networkd.socket',
'systemd-nspawn@.service',
'systemd-oomd.service',
'systemd-oomd.socket',
'systemd-portabled.service',
'systemd-poweroff.service',
'systemd-pstore.service',
'systemd-quotacheck.service',
'systemd-random-seed.service',
'systemd-reboot.service',
'systemd-remount-fs.service',
'systemd-repart.service',
'systemd-resolved.service',
'systemd-rfkill.service',
'systemd-rfkill.socket',
'systemd-suspend-then-hibernate.service',
'systemd-suspend.service',
'systemd-sysctl.service',
'systemd-sysext.service',
'systemd-sysupdate-reboot.service',
'systemd-sysupdate-reboot.timer',
'systemd-sysupdate.service',
'systemd-sysupdate.timer',
'systemd-sysusers.service',
'systemd-time-wait-sync.service',
'systemd-timedated.service',
'systemd-timesyncd.service',
'systemd-tmpfiles-clean.service',
'systemd-tmpfiles-clean.timer',
'systemd-tmpfiles-setup-dev.service',
'systemd-tmpfiles-setup.service',
'systemd-udev-settle.service',
'systemd-udev-trigger.service',
'systemd-udevd-control.socket',
'systemd-udevd-kernel.socket',
'systemd-udevd.service',
'systemd-update-done.service',
'systemd-update-utmp.service',
'systemd-user-sessions.service',
'systemd-userdbd.service',
'systemd-userdbd.socket',
'systemd-vconsole-setup.service',
'systemd-volatile-root.service',
'tailscaled.service',
'talk.service',
'talk.socket',
'teamd@.service',
'telnet.socket',
'telnet@.service',
'thermald.service',
'time-set.target',
'time-sync.target',
'timers.target',
'tlp.service',
'ua-timer.timer',
'udisks2-zram-setup@.service',
'udisks2.service',
'ufw.service',
'umount.target',
'unattended-upgrades.service',
'unbound-anchor.timer',
'update-notifier-download.timer',
'update-notifier-motd.timer',
'updatedb.service',
'updatedb.timer',
'upower.service',
'uresourced.service',
'usb_modeswitch@.service',
'usb-gadget.target',
'usbmuxd.service',
'user-runtime-dir@.service',
'user.slice',
'user@.service',
'uuidd.service',
'uuidd.socket',
'veritysetup-pre.target',
'veritysetup.target',
'virt-guest-shutdown.target',
'virtchd-admin.socket',
'virtchd-ro.socket',
'virtchd.service',
'virtchd.socket',
'virtinterfaced-admin.socket',
'virtinterfaced-ro.socket',
'virtinterfaced.service',
'virtinterfaced.socket',
'virtlockd-admin.socket',
'virtlockd.service',
'virtlockd.socket',
'virtlogd-admin.socket',
'virtlogd.service',
'virtlogd.socket',
'virtlxcd-admin.socket',
'virtlxcd-ro.socket',
'virtlxcd.service',
'virtlxcd.socket',
'virtnetworkd-admin.socket',
'virtnetworkd-ro.socket',
'virtnetworkd.service',
'virtnetworkd.socket',
'virtnodedevd-admin.socket',
'virtnodedevd-ro.socket',
'virtnodedevd.service',
'virtnodedevd.socket',
'virtnwfilterd-admin.socket',
'virtnwfilterd-ro.socket',
'virtnwfilterd.service',
'virtnwfilterd.socket',
'virtproxyd-admin.socket',
'virtproxyd-ro.socket',
'virtproxyd-tcp.socket',
'virtproxyd-tls.socket',
'virtproxyd.service',
'virtproxyd.socket',
'virtqemud-admin.socket',
'virtqemud-ro.socket',
'virtqemud.service',
'virtqemud.socket',
'virtsecretd-admin.socket',
'virtsecretd-ro.socket',
'virtsecretd.service',
'virtsecretd.socket',
'virtstoraged-admin.socket',
'virtstoraged-ro.socket',
'virtstoraged.service',
'virtstoraged.socket',
'virtvboxd-admin.socket',
'virtvboxd-ro.socket',
'virtvboxd.service',
'virtvboxd.socket',
'vpnc@.service',
'wazuh-agent.service',
'whoopsie.path',
'winbind.service',
'wpa_supplicant-nl80211@.service',
'wpa_supplicant-wired@.service',
'wpa_supplicant.service',
'wpa_supplicant@.service',
'xfs_scrub_all.service',
'xfs_scrub_all.timer',
'xfs_scrub_fail@.service',
'xfs_scrub@.service',
'xl2tpd.service',
'zfs-import-cache.service',
'zfs-import.target',
'zfs-load-key-rpool.service',
'zfs-load-module.service',
'zfs-mount.service',
'zfs-scrub.timer',
'zfs-share.service',
'zfs-snapshot-daily.timer',
'zfs-snapshot-daily.service',
'zfs-snapshot-frequent.service',
'zfs-snapshot-frequent.timer',
'zfs-snapshot-hourly.service',
'zfs-snapshot-hourly.timer',
'zfs-snapshot-monthly.timer',
'zfs-snapshot-monthly.service',
'zfs-snapshot-weekly.timer',
'zfs-snapshot-weekly.service',
'zfs-volume-wait.service',
'zfs-volumes.target',
'zfs-zed.service',
'zfs.target',
'znapzend.service',
'zpool-trim.timer'
)
OR id LIKE 'blockdev@dev-mapper-luks%.target'
OR id LIKE 'blockdev@dev-mapper-nvme%.target'
OR id LIKE 'dbus-:%-org.freedesktop.problems@0.service'
OR id LIKE 'dev-disk-by%.swap'
OR id LIKE 'dev-mapper-%.swap'
OR id LIKE 'dev-zram%.swap'
OR id LIKE 'docker-%.scope'
OR id LIKE 'getty@tty%.service'
OR id LIKE 'home-manager-%.service'
OR id LIKE 'lvm2-pvscan@%.service'
OR id LIKE 'session-%.scope'
OR id LIKE 'system-systemd%cryptsetup.slice'
OR id LIKE 'systemd-backlight@%.service'
OR id LIKE 'systemd-cryptsetup@luks%.service'
OR id LIKE 'systemd-cryptsetup@nvme%.service'
OR id LIKE 'systemd-fsck@dev-disk-by%service'
OR id LIKE 'systemd-zram-setup@zram%.service'
OR id LIKE 'user-runtime-dir@%.service'
OR id LIKE 'user@%.service'
OR id LIKE 'akmods@%64.service'
)
)