Lesson 1.40: Hunting persistence with osquery
An attacker who wants to come back leaves persistence: a cron line, a systemd service, an SSH key, a setuid shell. Each has its own file format and place, and checking them by hand on every server is slow and easy to get wrong. osquery has a table for each. In the lab the order API server app03 talked to the same address as web07. You sweep it with six queries, build a time window from file modification times, and export the hashes as indicators for the rest of the fleet.
18 min
You will learn to
- Query cron, systemd, SSH keys and setuid files as tables
- Use file mtimes to build a time window
- Join users with authorized_keys
- Export indicators as JSON
- Explain why each persistence type matters
Key terms
- Persistence
- Anything that brings the attacker's code back after a restart or a cleanup.
- crontab table
- All cron lines from /etc/crontab, /etc/cron.d and user crontabs.
- systemd_units
- Units with their state and fragment_path (the unit file in use).
- authorized_keys table
- Every SSH key in users' authorized_keys files; join with users.
- suid_bin
- Files with the setuid or setgid bit in binary directories.
- IOC
- Indicator of compromise: a hash, address or name that marks known-bad activity.
← File timelines and timestomping · All lessons · How malware gets in →