Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Great query <@U4MF4P00M>! <https://twitter.com/gepeto42/status/1128383095428743172>

:heart: that you called out the 172/12 issue there

Figured it was good enough for a quick query for most but at the same time I dislike articles that assume 172.16 to be a :16 :)

<@U4MF4P00M> Updated for `os_version` check (&lt;= Windows 2008 R2) <https://gist.github.com/defensivedepth/7a8a4f804818ca18c8ce46f8e0a8c5fd>

<@U2VPE4C0M> would looking for os_version.version &lt; 6.2 make more sense though?

Since client versions are impacted too and won't have a name that fits 201%

<@U4MF4P00M> Yes it would, except that `version` is a `text` datatype and `&lt; 6.2` won't work. Alternatively, I think the following would catch everything 2008 R2 / Win 7 &amp; below: `WHERE major &lt; 7 AND minor &lt; 2`

Is `remote_address` the… remote_address? Is this RDP things with a remote connection, not things that are listening?

Basically as soon as someone connects to you over the internet you'll see it <@U7QP20JQH>, considering how everything I ever put on the internet constantly receives connections over RDP I think it's sensible

hahahaha. Fair enough. Leveraging the constant scans as a canary mechanism

<@U4MF4P00M> Curious to hear how often you schedule this query in prod?

I think it really does not have to be frequent. The idea here is that there's constant connections, and you weed them out over time. 60m?

<@U2VPE4C0M> it's weird I was testing some stuff with os_version.version (ex: &lt; 11 on a Win10 box) and it worked - but it doesn't work with &gt;. I had not even realized it was a text

your query works, because luckily there is no minor above .2 for a major below, so that is nice :slightly_smiling_face:

Ya, I dont have osquery on XP in my env, so I couldnt test that :slightly_smiling_face:

It’s an event table. So query frequency may not mean what you think.

Honestly, I thought of it as a query I would run once to spot problems more than anything but yeah you're right

though the schema doesn't show it as evented... I think I need to stop staring at the 48 tabs I have open right now :slightly_smiling_face:

blah. You’re right. It’s _not_ evented. I dunno what query I saw that was.

socket_events is not supported on Windows :disappointed: