Tags: osquery/osquery
Tags
Preserve object identifiers in Windows certificates table via subject… …2/issuer2 (#8963) Resolves #8730 The Windows certificates table generated the `subject` and `issuer` columns with CertNameToStr using CERT_SIMPLE_NAME_STR, which discards the attribute keys (OIDs), unlike the Darwin and Linux implementations. This change populates the `subject2` and `issuer2` columns on Windows using CERT_X500_NAME_STR so the distinguished name keys (CN, O, OU, C, ...) are preserved, matching the key/value format used on the other platforms. Move these two columns into the base schema so they are available on all platforms. The existing `subject` and `issuer` columns are left unchanged for backward compatibility. Verified on Windows. <!-- The PR will be reviewed by an osquery committer. Here are some common things we look for: - Common utilities within `./osquery/utils` are used where appropriate (avoid reinventions). - Modern C++ structures and patterns are used whenever possible. - No memory or file descriptor leaks, please check all early-return and destructors. - No explicit casting, such as `return (int)my_var`, instead use `static_cast`. - The minimal amount of includes are used, only include what you use. - Comments for methods, structures, and classes follow our common patterns. - `Status` and `LOG(N)` messages do not use punctuation or contractions. - The code mostly looks and feels similar to the existing codebase. -->
Split yara tables into `yara_process` and `yara_file` (#8835) This PR splits the yara process scanning into its own table, while still sharing core code between the two tables. This allows us to define both `path` and `pid` as required fields in their respective tables; Resolves: #8816 ```sql osquery> select * from yara_file where (path = 'C:\bin\test.txt' or path LIKE 'C:\bin\%.ps1') and sigrule = 'rule always_true { condition: true }'; +----------------------------------+-------------+-------+-----------+---------+---------+------+ | path | matches | count | sig_group | sigfile | strings | tags | +----------------------------------+-------------+-------+-----------+---------+---------+------+ | C:\bin\test.txt | always_true | 1 | | | | | | C:\bin\osquery_build_prereqs.ps1 | always_true | 1 | | | | | | C:\bin\set_up_ssh_keys.ps1 | always_true | 1 | | | | | +----------------------------------+-------------+-------+-----------+---------+---------+------+ ``` ```sql osquery> select y.*, p.name, p.cmdline from yara_process as y JOIN processes as p using(pid) where pid in (select pid from processes where pid > 1000 limit 10) and sigrule = 'rule always_true { condition: true }'; +------+-------------+-------+-----------+---------+---------+------+-----------------+--------------------------------------------------------------------------------------+ | pid | matches | count | sig_group | sigfile | strings | tags | name | cmdline | +------+-------------+-------+-----------+---------+---------+------+-----------------+--------------------------------------------------------------------------------------+ | 1068 | always_true | 1 | | | | | svchost.exe | C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p | | 1100 | always_true | 1 | | | | | fontdrvhost.exe | "fontdrvhost.exe" | | 1108 | always_true | 1 | | | | | fontdrvhost.exe | "fontdrvhost.exe" | | 1204 | always_true | 1 | | | | | svchost.exe | C:\WINDOWS\system32\svchost.exe -k RPCSS -p | | 1248 | always_true | 1 | | | | | svchost.exe | C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSM | | 1312 | always_true | 1 | | | | | dwm.exe | "dwm.exe" | | 1496 | always_true | 1 | | | | | svchost.exe | C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts | | 1504 | always_true | 1 | | | | | svchost.exe | C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork -p | | 1544 | always_true | 1 | | | | | svchost.exe | C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc | | 1672 | always_true | 1 | | | | | svchost.exe | C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService | +------+-------------+-------+-----------+---------+---------+------+-----------------+--------------------------------------------------------------------------------------+ ``` --------- Co-authored-by: Zach Wasserman <zach@fleetdm.com>
Update osquery-toolchain to 1.2.0 (LLVM 11.0.0, zlib 1.2.13) (#8773) - LLVM 9.0.1 -> 11.0.0 - zlib 1.2.11 -> 1.2.13 Builds tested on - Ubuntu 16.04 (x86_64) - Ubuntu 18.04 (x86_64, aarch64) - Ubuntu 20.04 (x86_64, aarch64) - Ubuntu 22.04 (x86_64, aarch64) - Ubuntu 24.04 (x86_64, aarch64) - CentOS 6 (x86_64) - CentOS 7 (x86_64) - CentOS 8 (x86_64) - CentOS Stream 9 (x86_64, aarch64) - CentOS Stream 10 (aarch64)
Add support for gzip content-encoding in HTTP client (#8731) - Toggled via `--tls_accept_gzip` default off (may switch to default on in future releases) - Send headers indicating gzip support and decompress gzipped responses - Clean up existing gzip compression functoin and add decompression function - Update tests for roundtrip compression and integration testing gzip with an HTTP server
Filter the Win32_Processor query to only required fields (#8598) Querying Win32_Processor for all fields has a performance penalty of 1.1s per CPU core - this is mostly unnoticable on small boxes, but on larger boxes can actualloy have a significant impact on startup performance. Even on an 8 core system, this takes the startup time for osqueryi from 8.5s to 0.2s.
PreviousNext