sean.cavanaugh
11/15/2021, 5:06 PMyara
table. If I run a basic yara rule using the sigrule
column in osqueryi I get the intened results. If I run the same query via Fleet as a distributed query I get no results.
The below query identifies the test file as expected in osqueryi, but nothing at all is returned via Fleet.
select * from yara where path like "/Users/scavanaugh/Desktop/%" and sigrule = 'rule hello_world {
strings:
$a = "Hello world"
condition: $a
}';
Fleet is version 3.3.0
In osqueryi paths are returned for files that have no match, in Fleet this doesn’t appear to be the caseAndrew Bare
11/15/2021, 5:13 PMzwass
--verbose --tls_dump
and verify that Fleet is sending the correct query? What user is osqueryd running as?sean.cavanaugh
11/15/2021, 5:29 PMzwass
sean.cavanaugh
11/15/2021, 8:05 PMI1115 15:20:58.064646 186163200 distributed.cpp:121] Executing distributed query: kolide_distributed_query_952: select * from yara where path like "/Users/scavanaugh/Desktop/%" and sigrule = 'rule hello_world {
strings:
$a = "Hello world"
condition: $a
}'
and matches = 'hello_world';
I1115 15:21:00.946065 186163200 tls.cpp:255] TLS/HTTPS POST request to URI: https://<server>/api/v1/osquery/distributed/write
{"queries":{"kolide_distributed_query_952":[{"path":"/Users/scavanaugh/Desktop/hello world.txt","matches":"hello_world","count":"1","sig_group":"","sigfile":"","strings":"","tags":""}]},"statuses":{"kolide_distributed_query_952":0},"messages":{"kolide_distributed_query_952":""},"node_key":"BPxEBIaiP3N0yZmG2ope6XEVPO7z7+ub"}
{}
zwass
sean.cavanaugh
11/15/2021, 8:31 PMsudo /usr/local/bin/osqueryd --verbose \
--tls_dump \
--allow_unsafe \
--config_plugin=tls \
--config_refresh=900 \
--config_tls_refresh=900 \
--config_accelerated_refresh=300 \
--config_tls_endpoint=/api/v1/osquery/config \
--disable_distributed=false \
--disable_enrollment=false \
--disable_tables=shell_history \
--distributed_interval=10 \
--distributed_plugin=tls \
--distributed_tls_max_attempts=3 \
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read \
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write \
--enroll_secret_path=/var/osquery/kolide_secret \
--enroll_tls_endpoint=/api/v1/osquery/enroll \
--host_identifier=hostname \
--logger_min_status=1 \
--logger_plugin=tls \
--logger_snapshot_event_type=true \
--logger_tls_endpoint=/api/v1/osquery/log \
--logger_tls_period=10 \
--pack_delimiter=/ \
--tls_hostname=<server> \
--tls_server_certs=<cert> \
--enable_file_events=true
sudo osqueryctl start
(after killing osqueryd)zwass
sean.cavanaugh
11/15/2021, 8:33 PMzwass
sudo osqueryi
followed by .connect
sean.cavanaugh
11/15/2021, 8:35 PM.connect
zwass
sean.cavanaugh
11/15/2021, 8:37 PM-> % sudo osqueryi
Password:
Using a virtual database. Need help, type '.help'
osquery> .connect
Error: unknown command or invalid arguments: "connect". Enter ".help" for help
zwass
select version from osquery_info
in that shell?.connect /var/osquery/osquery.em
sean.cavanaugh
11/15/2021, 9:16 PMzwass