Hi everyone I'm trying to setup yara events scan, but for some reason no events being triggered:

osquery.conf

(partial):

"file_paths": {
    "configuration": [
      "/etc/passwd",
      "/etc/shadow",
      "/etc/ld.so.preload",
      "/etc/ld.so.conf",
      "/etc/ld.so.conf.d/%%",
      "/etc/pam.d/%%",
      "/etc/resolv.conf",
      "/etc/rc%/%%",
      "/etc/my.cnf",
      "/etc/modules",
      "/etc/hosts",
      "/etc/hostname",
      "/etc/fstab",
      "/etc/crontab",
      "/etc/cron%/%%",
      "/etc/init/%%",
      "/etc/rsyslog.conf"
    ],
    "binaries": [
      "/usr/bin/%%",
      "/usr/sbin/%%",
      "/bin/%%",
      "/sbin/%%",
      "/usr/local/bin/%%",
      "/usr/local/sbin/%%"
    ]
  },

  "packs": {
    "yara-events": "/opt/osquery/extra/yara-events.conf"
},
  "yara": {
    "signatures": {      
      "eicar": [ "/opt/osquery/yara/eicar.yar" ]
    },
    "file_paths": {
      "configuration": [ "eicar" ],
      "binaries": [ "eicar" ]
    }
  },
...

`/opt/osquery/extra/yara-events.conf`:

{
  "platform": "linux",
  "version": "1.0.0",
  "queries": {
    "yara_events": {
      "description": "Yara Events",
      "interval": 60,
      "name": "yara_events",
      "query": "SELECT *, datetime(time,'unixepoch','utc') AS time FROM yara_events;"
    }
  }
}

So in logs I see:

osqueryd[17741]: I0125 11:37:55.570081 17741 yara_utils.cpp:376] Compiling YARA signature group: eicar

So from this I can conclude that rules were successfully found and compiled, even more then that I'm able to trigger alerts via osqueryi ONLY if I'll supply file path explicitly not

/usr/bin/%%

nor

/usr/bin/%%

:

SELECT * FROM yara WHERE path="/usr/bin/eicar.com" AND sig_group="eicar";
+--------------------+------------------------------------+-------+-----------+---------+------------------------------------+------+
| path               | matches                            | count | sig_group | sigfile | strings                            | tags |
+--------------------+------------------------------------+-------+-----------+---------+------------------------------------+------+
| /usr/bin/eicar.com | eicar_av_test,eicar_substring_test | 2     | eicar     |         | $eicar_regex:0,$eicar_substring:1b |      |
+--------------------+------------------------------------+-------+-----------+---------+------------------------------------+------+