Ted Dorosheff
12/02/2021, 5:58 PMSELECT action, category, old_path, path, file_attributes, time FROM ntfs_journal_events;
my agent config
config:
options:
events_expiry: 60
config_refresh: 600
host_identifier: instance
distributed_interval: 60
decorators:
load:
- >-
SELECT COALESCE((select instance_id FROM ec2_instance_metadata),
hostname) as hostname FROM system_info;
file_paths:
etc:
- /etc/group
- /etc/passwd
- /etc/shadow
- /etc/services
- /etc/sudoers
- /etc/ld.so.preload
- /etc/ld.so.conf
- /etc/ld.so.conf.d/%%
- /etc/pam.d/%%
- /etc/resolv.conf
- /etc/modules
- /etc/hosts
- /etc/hostname
- /etc/fstab
- /etc/rsyslog.conf
ssh:
- /root/.ssh/%%
- /home/%/.ssh/%%
- /etc/ssh/%%
- /var/lib/sia/keys/
- /var/lib/sia/certs/
logs:
- /var/log/secure
docker:
- /etc/docker/%%
- /etc/default/docker
- /etc/docker/daemon.json
- /usr/bin/containerd
- /usr/sbin/runc
- /etc/sysconfig/docker
- /usr/lib/systemd/system/docker.service
- /usr/lib/systemd/system/docker.socket
osquery:
- /etc/osquery/%%
- /usr/share/osquery/packs/%%
firewalls:
- /etc/sysconfig/iptables
- /home/y/conf/yakl/%%
- /etc/yakl/conf/%%
overrides:
platforms:
windows:
options:
events_expiry: 60
config_refresh: 600
host_identifier: instance
distributed_interval: 60
decorators:
load:
- >-
SELECT COALESCE((select instance_id FROM ec2_instance_metadata),
hostname) as hostname FROM system_info;
file_paths:
users:
- 'C:\users\AppData\Roaming'
- 'C:\users\AppData\Local'
- 'C:\users\AppData\Local\temp'
- >-
C:\users\AppData\Roaming\Microsoft\Windows\Start
Menu\Programs\Startup
- 'C:\users\AppData\Roaming\Microsoft\Windows\Start Menu\Programs'
- 'C:\Users\Default'
windows:
- 'C:\Windows'
- 'C:\Windows\temp'
- 'C:\Windows\system32\Drivers'
- 'C:\Windows\SysWOW64\Drivers'
- 'C:\Windows\system32\GroupPolicy\Machine\Scripts'
- 'C:\Windows\system32\GroupPolicy\User\Scripts'
- 'C:\Windows\system32\Wbem'
- 'C:\Windows\SysWOW64\Wbem'
- 'C:\Windows\system32\WindowsPowerShell'
- 'C:\Windows\SysWOW64\WindowsPowerShell'
- 'C:\Windows\Tasks'
- 'C:\Windows\system32\Tasks'
- 'C:\Windows\AppPatch\Custom%'
ProgramData:
- 'C:\ProgramData\Microsoft\Windows\Start Menu'
- 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs'
exclude_paths:
windows:
- 'C:\Windows\system32\DriverStore\Temp\%'
- 'C:\Windows\system32\wbem\Performance%'
- 'C:\$WINDOWS.~BT\Sources\%'
- 'C:\Windows\Installer\%'
- 'C:\Windows\System32\Tasks\Adobe Acrobat Update Task%'
- 'C:\Windows\System32\Tasks\Adobe Flash Player Updater%'
- >-
C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask%
@Mystery Incorporated helped with this before, if you could just give me another look that would be much appreciated. I'm really lost.Mystery Incorporated
12/03/2021, 5:47 AMzwass
12/03/2021, 6:28 PMselect * from osquery_events
to see whether the publishers are activated and receiving any events.Ted Dorosheff
01/06/2022, 7:52 PMLog file created at: 2021/12/27 11:01:32
Running on machine: COOLEDRULED
Log line format: [IWEF]mmdd hh:mm:ss.uuuuuu threadid file:line] msg
I1227 11:01:32.819942 5964 eventfactory.cpp:156] Event publisher not enabled: ntfs_event_publisher: NTFS event publisher disabled via configuration
zwass
01/06/2022, 7:56 PMTed Dorosheff
01/06/2022, 8:01 PM--enable_windows_events_publisher=true
--enable_windows_events_subscriber=true
--enable_ntfs_event_publisher=true
They were currently missing from my flags file--enable_ntfs_event_publisher=true
zwass
01/06/2022, 8:20 PMwindows_events
ones would be for the windows_events
table.Ted Dorosheff
01/06/2022, 8:30 PMosqueryi.exe -S --config_path="C:\Program Files\osquery\osquery.conf" --disable_events=false --enable_windows_events_publisher=true --enable_windows_events_subscriber=true --enable_ntfs_event_publisher=true --verbose
But i'm guessing that file_paths still needs to be defined? We have file_paths set in our yaml config in fleetDM, but i would assume that isn't being loaded if i'm running osqueryi like this?osquery> select * from osquery_events;
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| name | publisher | type | subscriptions | events | refreshes | active |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| WindowsEventLogPublisher | WindowsEventLogPublisher | publisher | 1 | 17 | 0 | 1 |
| ntfs_event_publisher | ntfs_event_publisher | publisher | 0 | 0 | 934 | 1 |
| ntfs_journal_events | ntfs_event_publisher | subscriber | 0 | 0 | 0 | 1 |
| powershell_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
| windows_events | WindowsEventLogPublisher | subscriber | 1 | 437 | 0 | 1 |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
osquery>
zwass
01/06/2022, 8:39 PMTed Dorosheff
01/06/2022, 8:39 PMzwass
01/06/2022, 8:40 PMosqueryi
with the normal flagfile so it pulls the config from Fleet?Ted Dorosheff
01/06/2022, 8:40 PMC:\Program Files\osquery>osqueryi.exe
Using a [1mvirtual database[0m. Need help, type '.help'
osquery> select * from osquery_events;
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| name | publisher | type | subscriptions | events | refreshes | active |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| WindowsEventLogPublisher | WindowsEventLogPublisher | publisher | 0 | 0 | 0 | 0 |
| ntfs_event_publisher | ntfs_event_publisher | publisher | 0 | 0 | 0 | 0 |
| ntfs_journal_events | ntfs_event_publisher | subscriber | 0 | 0 | 0 | 0 |
| powershell_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
| windows_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
osquery>
zwass
01/06/2022, 8:44 PM--flagfile
Ted Dorosheff
01/06/2022, 8:44 PMzwass
01/06/2022, 8:47 PMTed Dorosheff
01/06/2022, 8:47 PMC:\Program Files>osquery\osqueryi.exe --flagfile="C:\Program Files\osquery\osquery.flags"
Using a [1mvirtual database[0m. Need help, type '.help'
osquery>
osquery> select * from osquery_events;
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| name | publisher | type | subscriptions | events | refreshes | active |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| WindowsEventLogPublisher | WindowsEventLogPublisher | publisher | 0 | 0 | 0 | 1 |
| ntfs_event_publisher | ntfs_event_publisher | publisher | 3 | 0 | 0 | 0 |
| ntfs_journal_events | ntfs_event_publisher | subscriber | 3 | 0 | 0 | 1 |
| powershell_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
| windows_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
osquery>
zwass
01/06/2022, 9:18 PMselect * from ntfs_journal_events;
Ted Dorosheff
01/06/2022, 11:42 PMosquery> select * from osquery_events;
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| name | publisher | type | subscriptions | events | refreshes | active |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| WindowsEventLogPublisher | WindowsEventLogPublisher | publisher | 0 | 0 | 0 | 1 |
| ntfs_event_publisher | ntfs_event_publisher | publisher | 3 | 0 | 0 | 0 |
| ntfs_journal_events | ntfs_event_publisher | subscriber | 3 | 0 | 0 | 1 |
| powershell_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
| windows_events | WindowsEventLogPublisher | subscriber | 0 | 0 | 0 | 0 |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
osquery> select * from ntfs_journal_events;
osquery>
C:\Users\*\foo
C:\Users\*\bar
Running this in an enterprise environment where the username is going to be different on every machine.zwass
01/07/2022, 1:19 AM\%
if you're looking to cover files in those directories.Ted Dorosheff
01/07/2022, 4:25 PMC:\Users\%\foo\%
to wildcard the unique username string, and then everything in some subdirectory within the users home directory?
C:\Users\foo\%
or like this? This one seems like it would only work on some user named "foo"file_paths
entries, as well as specific exclude_paths
entries. This seems like it would be unnecessary, because if you are doing
file_paths
- A
- B
- C
exclude_paths
- D
- E
- F
wouldn't "D" "E" "F" be implicitly excluded since they are not under file_paths
?config:
options:
events_expiry: 60
config_refresh: 600
host_identifier: instance
distributed_interval: 60
decorators:
load:
- >-
SELECT COALESCE((select instance_id FROM ec2_instance_metadata),
hostname) as hostname FROM system_info;
file_paths:
etc:
- /etc/group
- /etc/passwd
- /etc/shadow
- /etc/services
- /etc/sudoers
- /etc/ld.so.preload
- /etc/ld.so.conf
- /etc/ld.so.conf.d/%%
- /etc/pam.d/%%
- /etc/resolv.conf
- /etc/modules
- /etc/hosts
- /etc/hostname
- /etc/fstab
- /etc/rsyslog.conf
ssh:
- /root/.ssh/%%
- /home/%/.ssh/%%
- /etc/ssh/%%
- /var/lib/sia/keys/
- /var/lib/sia/certs/
logs:
- /var/log/secure
docker:
- /etc/docker/%%
- /etc/default/docker
- /etc/docker/daemon.json
- /usr/bin/containerd
- /usr/sbin/runc
- /etc/sysconfig/docker
- /usr/lib/systemd/system/docker.service
- /usr/lib/systemd/system/docker.socket
osquery:
- /etc/osquery/%%
- /usr/share/osquery/packs/%%
firewalls:
- /etc/sysconfig/iptables
- /home/y/conf/yakl/%%
- /etc/yakl/conf/%%
overrides:
platforms:
windows:
options:
events_expiry: 60
config_refresh: 600
host_identifier: instance
distributed_interval: 60
decorators:
load:
- >-
SELECT COALESCE((select instance_id FROM ec2_instance_metadata),
hostname) as hostname FROM system_info;
file_paths:
users:
- 'C:\users\AppData\Roaming'
- 'C:\users\AppData\Local'
- 'C:\users\AppData\Local\temp'
- >-
C:\users\AppData\Roaming\Microsoft\Windows\Start
Menu\Programs\Startup
- 'C:\users\AppData\Roaming\Microsoft\Windows\Start Menu\Programs'
- 'C:\Users\Default'
windows:
- 'C:\Windows'
- 'C:\Windows\temp'
- 'C:\Windows\system32\Drivers'
- 'C:\Windows\SysWOW64\Drivers'
- 'C:\Windows\system32\GroupPolicy\Machine\Scripts'
- 'C:\Windows\system32\GroupPolicy\User\Scripts'
- 'C:\Windows\system32\Wbem'
- 'C:\Windows\SysWOW64\Wbem'
- 'C:\Windows\system32\WindowsPowerShell'
- 'C:\Windows\SysWOW64\WindowsPowerShell'
- 'C:\Windows\Tasks'
- 'C:\Windows\system32\Tasks'
- 'C:\Windows\AppPatch\Custom%'
ProgramData:
- 'C:\ProgramData\Microsoft\Windows\Start Menu'
- 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs'
exclude_paths:
windows:
- 'C:\Windows\system32\DriverStore\Temp\%'
- 'C:\Windows\system32\wbem\Performance%'
- 'C:\$WINDOWS.~BT\Sources\%'
- 'C:\Windows\Installer\%'
- 'C:\Windows\System32\Tasks\Adobe Acrobat Update Task%'
- 'C:\Windows\System32\Tasks\Adobe Flash Player Updater%'
- >-
C:\Windows\System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask%