https://github.com/osquery/osquery logo
#general
Title
# general
n

nebi

07/30/2018, 1:30 AM
but there is no entry for this command
y

yuvalapidot

07/30/2018, 12:08 PM
Process table does not log scripts (like the one you described). However, i believe that the curl process should appear. If you run a query for the processes table right when the curl is running, it should be showing, but it might be hard to get it in the exact moment in time.
s

stefanmaerz

07/30/2018, 12:44 PM
yeah that is what i was thinking. you are probably creating a race condition. I bet you will see the curl process if you download a big file (that takes more time) using curl
a

ag4ve

07/30/2018, 11:11 PM
Auditd (kernel hook) should see the processes - while and test are (most likely) internal to your shell
Also, I'm pretty sure audit won't directly catch echo > /dev/tcp/ip/port stuff if you're trying to catch that type of behavior
4 Views