Michael Greenberg

12/11/2022, 11:20 AM
Hi. We occasionally have a problem when running the osquery shell on Windows. Normally, the queries we run take a fraction of a second. Occasionally (like 1 in 100 times) , they take a very long time (more than two minutes). Perhaps the only 'interesting' thing is that the osquery.exe is invoked from a service running as 'local system account'. We had at least one case where we had to reboot the Windows machine for the queries to take a normal amount of time. The queries (sent to
osquery --json
via stdin) were
select sha1 from certificates where store_location = "LocalMachine" and upper(sha1) = '0C40F468D84B158856FFD52406378E397C016EF2' ;
select key from registry where key = 'HKEY_LOCAL_MACHINE\SOFTWARE\xxxxx' and name = 'yyyyy' and data like '0' ;
select name from windows_security_products where type = 'Antivirus' and state = 'On';
Is there any known issue that might cause this to happen ? Is there a way I can debug this? This is with osquery 5.4.0 Thanks