Title
#general
t

Tomas Mendia

12/13/2021, 8:07 PM
Does anyone know a osquery table that can show packages running on a remote endpoint? Trying to find a way to confirm Log4jl on remote systems that I don't have access except with osquery
t

Tomas Mendia

12/13/2021, 9:26 PM
We tried those. None of them seemed to work. I'm currently working on figuring out why, but thought I would ask to see if anyone else was working on this also. I appreciate the reply!
s

seph

12/13/2021, 9:34 PM
What does "packages running on a remote endpoint" mean here?
m

MarkMurdock

12/13/2021, 9:42 PM
Tomas, I used these YARA rules to help find log4j dependencies with osquery and it definitely helped:https://github.com/timb-machine/log4j
Gavin

Gavin

12/13/2021, 10:13 PM
Please take a look at this thread in #fleet https://osquery.slack.com/archives/C01DXJL16D8/p1639196602341300
CyberUnify

CyberUnify

12/20/2021, 12:49 PM
what about using osquery to check for windows server log4j?
koo

koo

12/20/2021, 12:53 PM
CyberUnify

CyberUnify

12/20/2021, 7:10 PM
the thing is that there is no process_open_files for Windows Servers
s

Stephen Boyle

12/21/2021, 9:56 PM
same question here....
Gavin

Gavin

12/22/2021, 12:35 PM
You may want to look at building a list of known paths off of the environment variable java_home vs processes open on windows then compile a static list of locations to check this will be less performant but give you similar info