Lesson 1.16: Hunting processes and connections with osquery
osquery turns a running Linux system into a set of SQL tables: processes, open sockets, listening ports, users, cron jobs, files and more. Instead of chaining ps, ss and grep and reading by eye, you ask precise questions and join the answers, and the same questions can run every few minutes on every server. In the lab the partner portal web07 is slow. You use five queries to find a miner running from a deleted file, a bind shell started by the web server, and their connections, then save the questions as a query pack for the whole fleet.
18 min
You will learn to
- Query live system state with osqueryi
- Join processes with sockets and listening ports
- Find processes running from deleted files
- Spot unexpected children of a service account
- Turn hunting queries into a scheduled pack
Key terms
- osquery
- An agent that exposes the operating system as SQL tables; osqueryi is the interactive shell, osqueryd the daemon.
- JOIN … USING (pid)
- Combines rows of two tables that share a column value.
- on_disk
- processes column: 1 file exists, 0 deleted, -1 unknown.
- Query pack
- A JSON file of named queries with intervals that osqueryd runs on schedule.
- Differential results
- osqueryd logs only rows added or removed since the last run.
- Bind shell
- A shell listening on a port, waiting for an attacker to connect.
← Login records and their gaps · All lessons · Types of malware →