Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
d
doteater
05/16/2019, 7:10 PMhey folks working with yara_events. It seems like FIM works against both directories when I specify them like this:
"file_paths": {
"home": [ "/root/%%", "/home/%%" ]
}
...but when I add the yara part like below, I'm only seeing yara_events related to the first path in the home "category" - in this example I can see events for files under /root, but not for files under /home:
"file_paths": {
"home": [ "/root/%%", "/home/%%" ]
},
"yara": {
"signatures": {
"sig_group_1": [ "/root/rules.yara" ]
},
"file_paths": {
"home": [ "sig_group_1" ]
}
}
Thanks in advance for any ideas. Does this syntax appear to be correct?
z
zwass
05/16/2019, 7:12 PMI don't have experience configuring yara, but does this explain the behavior you were asking about in #kolide?
d
doteater
05/16/2019, 7:14 PMmay be related, I figured I'd see if I can get it to work with vanilla osquery before I try and move it into fleet
z
zwass
05/16/2019, 7:14 PMThat seems like a good idea. Sorry I can't be more helpful here.
r
ryanbreed
05/16/2019, 7:27 PMi've got this working on macos/debian - i think .
yara.signatures.sig_group_1.file_paths.homeah hell nm
i'm using the same syntax (linux flavor):
"yara": {
"signatures": {
"sig_secrets": [ "secrets.yara" ]
},
"file_paths": {
"system_config": ["sig_secrets"],
"homes": ["sig_secrets"]
}
},
"file_paths": {
"system_config": [ "/etc/%%", "/usr/local/etc/%%" ],
"homes": [ "/home/%%" ]
},z
zwass
05/16/2019, 7:37 PMThe syntax looks correct to me
r
ryanbreed
05/16/2019, 7:49 PMi see the same behavior, the second+ path in any
file_pathsosquery 3.3.2-1.linuxp
packetzero
05/16/2019, 8:01 PMMy example config looks similar: ```
{
"yara": {
"signatures": {
"linux_malware": [
"./linux_malware.rules"
],
"hunt_webshells": [
"./hunt_webshells.rules"
]
},
"file_paths": {
"webserver": [
"linux_malware",
"hunt_webshells"
],
"binaries": [
"linux_malware"
]
}
},
"file_paths": {
"webserver": [
"/var/www/%%"
],
"binaries": [
"/bin/%%"
]
}
}r
ryanbreed
05/16/2019, 8:21 PMwhat's wild is that i can see the entries in
file_eventsand i do get yara findings running manually/recursive on the same paths
and i'm getting the same on macos/debian
p
packetzero
05/16/2019, 8:27 PMoh, just re-read your question.
Yes, it's likely first matching path wins, based on my memory of the code
r
ryanbreed
05/16/2019, 8:32 PMrefactoring
file_paths"yara": {
"signatures": {
"sig_secrets": [ "secrets.yara" ]
},
"file_paths": {
"system_config": ["sig_secrets"],
"system_local_config": ["sig_secrets"],
"home_root": ["sig_secrets"],
"home_users": ["sig_secrets"]
}
},
"file_paths": {
"system_config": [ "/etc/%%"],
"system_local_config": [ "/usr/local/etc/%%"],
"home_root": [ "/root/%%" ],
"home_users": [ "/home/%%" ]
},haven't tried duplicating
.yara.file_paths.file_paths@packetzero first matching path of the yara sig group?
p
packetzero
05/16/2019, 9:48 PMthe yara_events.cpp file is not large. It could use some attention. Specifically, why it gets vector of file_paths for a category, and then iterates on the categories within?
https://github.com/osql/osql/blob/5188ce5288abe0e323b8e8bd364f452134a62d00/osquery/tables/yara/yara_events.cpp#L173
🤔 1
r
ryanbreed
05/16/2019, 11:17 PMtime to remember cpp collections