liveBook · Manning

Process_open_sockets table

As explained in Cyber Threat Hunting

The process_open_sockets table is an osquery virtual table containing processes and their currently open network sockets.

The osquery process_open_sockets table records processes that currently have open network sockets. Join it with the processes table to attribute a suspicious network connection to a process, including its PID, name, local address and port, and remote address and port. section 6.1.5

Treat its results as a point-in-time view. A query can return no match after a short-lived connection has closed; when investigating periodic beaconing, repeat the query until the connection is active. section 6.1.5

Identify the process behind a suspected beacon

Filter process_open_sockets by remote address and join processes by PID. For connections to 34.125.188.180, repeated querying identifies powershell.exe using local port 54063 to reach remote port 80, linking the observed traffic to a Windows process. section 6.1.5

Listing 6.43 Listing processes connecting to 34.125.188.180
SELECT DISTINCT
  pos.pid,
  p.name,
  pos.local_address,
  pos.local_port,
  pos.remote_address,
  pos.remote_port
FROM
  processes p
  JOIN process_open_sockets pos USING (pid)
WHERE
  pos.remote_address like "%34.125.188.180%"            #1

Use this query pattern to select process and socket fields, join on PID, and filter for a suspected remote address. section 6.1.5

Endpoint socket evidence can also resolve disagreements in telemetry. When Splunk Stream reported a connection involving port 23456, packet capture showed inbound SYN packets followed by local TCP RESET packets because no endpoint service listened on that port; packet capture was trusted over the conflicting event. section 7.1.8

How Cyber Threat Hunting covers it

How deep it goes
Demonstrates a joined osquery query and explains why transient sockets require repeated collection, without detailing table internals.
Examples
Uses a PowerShell connection to 34.125.188.180:80 and a disputed TCP port 23456 event.
What it assumes
Uses osquery queries and basic network address and port fields without establishing broader prerequisites.
What you can do after
Diagnose/debug with it by repeatedly querying osquery to associate an active suspicious connection with its owning process.
How it connects
Connects osquery with the processes table, beaconing, PowerShell, TCP packet capture, and Splunk Stream.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.