Tudor
08/19/2021, 12:44 AMMystery Incorporated
08/19/2021, 4:48 AMpuffycid
08/19/2021, 11:22 PMwindows_eventlog
or windows_events
. Linux would likely use syslog_events
. macOS probably unified access logs (ual)? (https://github.com/osquery/osquery/pull/7259)
2. Same as above, logs would likely be the best way to get this info
3. For monitoring/investigating executed programs u could try:
• Linux perhaps: bash_history
, process_events
, and syslog_events
.
• macOS perhaps: bash_history
, process_events
, and ual
• Windows perhaps: shimcache
, userassist
, prefetch
, background_activities_moderator
, windows_eventlog
4. This one may be a little tricky to monitor but some ideas:
• macOS: apps
, homebrew_packages
, package_install_history
, maybe UAL?, maybe bash_history
?
• Linux: deb_packages
, rpm_packages
,maybe syslog_events
?, maybe bash_history
?
• Windows: programs
, registry
, maybe windows_eventlog
?
5. This one is a little difficult, im not aware of anyway to monitor when a screenshot is taken. But some ideas if want to monitor important files or investigate if a file was opened:
Windows:
◦ office_mru
will show office documents that are opened by a user
◦ shellbags
will show directories accessed by a user,
◦ shortcuts
will show files accessed,
◦ maybe (hopefully) in the future jumplists
(https://github.com/osquery/osquery/pull/7260) will show files accessed,
◦ browser history on windows systems will also sometimes record files that are opened, but browser history is not supported on osquery
u could also try file monitoring on windows for screenshots (ex: "screenshot_%") but that will probably be noisy
u could also try querying for installed 3rd part screenshot utilities
hope this helps a bit