Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi, I am working on creating yara rule to find webshells using fleet. Can someone advise me how to do it ? I am new to Fleet/OSquery/Yara:relaxed:

<https://github.com/DarkenCode/yara-rules/blob/master/malware/Webshell-shell.yar>

<https://osquery.readthedocs.io/en/4.5.0/deployment/yara/>

I haven't done this personally but that should get you started.

Those are great resources! If you run in to trouble along the way, don't hesitate to reach out. 

let me know if you get yara rules to load from url, I am having trouble getting it working right now. It does seem to work with files though

heres our github issues about it
<https://github.com/osquery/osquery/issues/7308>