osquery is an open-source operating-system instrumentation tool that exposes endpoint telemetry as relational data queried with SQL. It gives threat hunters direct access to process executions, network connections, registry data, kernel modules, browser plugins, hardware events, and file hashes, including artifacts not stored centrally. section 1.7 section 6.1.4
Use osquery during an investigation by combining endpoint queries with hypothesis testing:
- Search running processes and command lines for an expected application or suspicious term. section 7.1.4
- Join processes with open sockets to identify which process communicates with a destination address. section 7.1.4
- Inspect command-line arguments for hidden or encoded execution, then decode suspicious content for analysis. section 7.1.4
- Retrieve process paths and SHA-256 hashes to distinguish legitimate software from renamed or substituted processes. section 6.1.4 section 7.1.4
Following a suspicious Dropbox connection
A search for Dropbox processes returns no results, so the investigation pivots to processes connecting to 162.125. That query reveals PowerShell using a hidden, Base64-encoded command rather than Dropbox. A later endpoint check finds both genuine Dropbox connections and the suspicious PowerShell connection, preventing an assumption that every connection to the address is benign. section 7.1.4
Listing 6.4 Osquery SQL-based query
SELECT p.pid, p.name, p.path, p.cmdline, p.state, h.sha256 \ FROM processes p INNER JOIN hash h ON p.path=h.path; #1
Query running processes and join them with the hash table to retrieve executable paths, states, and SHA-256 values. section 6.1.4
