doteater
05/16/2019, 7:10 PMzwass
05/16/2019, 7:12 PMdoteater
05/16/2019, 7:14 PMzwass
05/16/2019, 7:14 PMryanbreed
05/16/2019, 7:27 PMyara.signatures.sig_group_1
key needs to be named 'home' to match .file_paths.home
. not sure how it's working at the moment."yara": {
"signatures": {
"sig_secrets": [ "secrets.yara" ]
},
"file_paths": {
"system_config": ["sig_secrets"],
"homes": ["sig_secrets"]
}
},
"file_paths": {
"system_config": [ "/etc/%%", "/usr/local/etc/%%" ],
"homes": [ "/home/%%" ]
},
zwass
05/16/2019, 7:37 PMryanbreed
05/16/2019, 7:49 PMfile_paths
filter doesn't show in yara_events - deb osquery 3.3.2-1.linux
. will verify w/ macospacketzero
05/16/2019, 8:01 PM{
"yara": {
"signatures": {
"linux_malware": [
"./linux_malware.rules"
],
"hunt_webshells": [
"./hunt_webshells.rules"
]
},
"file_paths": {
"webserver": [
"linux_malware",
"hunt_webshells"
],
"binaries": [
"linux_malware"
]
}
},
"file_paths": {
"webserver": [
"/var/www/%%"
],
"binaries": [
"/bin/%%"
]
}
}
ryanbreed
05/16/2019, 8:21 PMfile_events
, just no yara results.packetzero
05/16/2019, 8:27 PMryanbreed
05/16/2019, 8:32 PMfile_paths
to point to single/uniquely-keyed entries produces expected results:
"yara": {
"signatures": {
"sig_secrets": [ "secrets.yara" ]
},
"file_paths": {
"system_config": ["sig_secrets"],
"system_local_config": ["sig_secrets"],
"home_root": ["sig_secrets"],
"home_users": ["sig_secrets"]
}
},
"file_paths": {
"system_config": [ "/etc/%%"],
"system_local_config": [ "/usr/local/etc/%%"],
"home_root": [ "/root/%%" ],
"home_users": [ "/home/%%" ]
},
.yara.file_paths
sig group names across arraylen(.file_paths
) yet, but my config isn't so crazy to need more than what i've got workingpacketzero
05/16/2019, 9:48 PMryanbreed
05/16/2019, 11:17 PM