【WD团队】【宝塔面板】【技术分享】osquery检测linux

村长发表于 2022-1-28 22:22:45

osquery 安装如下：
配置文件如下

# cat /etc/osquery/osquery.conf
{
"options": {
"config_plugin": "filesystem",
"logger_plugin": "filesystem",
"utc": "true"
},

"schedule": {
"system_info": {
   "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
   "interval": 3600
},
   "behavioral_reverse_shell": {
"query" : "SELECT DISTINCT(processes.pid), processes.parent, processes.name, processes.path, processes.cmdline, processes.cwd, processes.root, processes.uid, processes.gid, processes.start_time, process_open_sockets.remote_address, process_open_sockets.remote_port, (SELECT cmdline FROM processes AS parent_cmdline WHERE pid=processes.parent) AS parent_cmdline FROM processes JOIN process_open_sockets USING (pid) LEFT OUTER JOIN process_open_files ON processes.pid = process_open_files.pid WHERE (name='sh' OR name='bash' OR name='nc') AND remote_address NOT IN ('0.0.0.0', '::', '');",
"interval" : 10,
"description" : "Find shell processes that have open sockets"
}
},
"decorators": {
"load": [
   "SELECT uuid AS host_uuid FROM system_info;",
   "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
]
},
"packs": {

日志如下:/var/log/osquery/osqueryd.results.log

# tail -f/var/log/osquery/osqueryd.results.log
<blockquote>{"name":"behavioral_reverse_shell","hostIdentifier":"localhost.localdomain","calendarTime":"Sat Jun1 09:12:30 2019 UTC","unixTime":1559380350,"epoch":0,"counter":880,"decorations":{"host_uuid":"564DBA8F-DC7F-D491-DF58-A9908DA09B80","username":"root"},"columns":{"cmdline":"bash -i","cwd":"/root","gid":"0","name":"bash","parent":"63338","parent_cmdline":"-bash","path":"/usr/bin/bash","pid":"64411","remote_address":"127.0.0.1","remote_port":"8888","root":"/","start_time":"3887087","uid":"0"},"action":"added"}

大司命 发表于 2022-1-29 17:10:17

无论是不是沙发都得回复下

千面萌萌 发表于 2022-1-30 10:20:09

顶

千百渡 发表于 2022-1-31 22:31:05

向楼主学习

伴我多久 发表于 2022-1-31 22:39:39

好帖必须得顶起

yichong 发表于 2022-2-3 14:55:11

我是个凑数的。。。

liqiang24 发表于 2022-2-3 21:03:58

珍爱生命，果断回帖。

页: [1]

村长黑科技's Archiver

【WD团队】【宝塔面板】【技术分享】osquery检测linux