https://github.com/osquery/osquery logo
Title
k

Kathy Satterlee

08/11/2022, 4:15 PM
g

Guillaume

08/11/2022, 4:18 PM
git clone -b defcon <https://github.com/ksatter/fleet-docker.git>
k

Kathy Satterlee

08/11/2022, 4:30 PM
g

Guillaume

08/11/2022, 4:46 PM
The password for the Workshop instance is :
DEFCON2022workshop!
- your usernames are on the card I gave you - if you don’t have one yet pick it up by the projector!
k

Kathy Satterlee

08/11/2022, 5:14 PM
g

Guillaume

08/11/2022, 6:32 PM
YARA example query:
sql
SELECT * FROM yara WHERE path like ‘/root/%%’ AND sigrule IN (
    ‘rule eicar {
    strings:
    $s1 = “X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*” fullword ascii
    condition:
    all of them
}’
) AND matches=‘eicar’;