is there any way to securely store values inside osquery For

Question

is there any way to securely store values inside osquery For example a list of valid trusted file sha sums

seph · Answer

Sorta but not really

seph · Answer

You can create temp tables and I think these will last for a bit But that s not really well quantified

seph · Answer

You can drop this information onto local disk somewhere and then join against it What formats depend a bit on the platform but sqlite is probably universal

seph · Answer

You can write an extension Which may provide some info like this

slevchenko · Answer

< seph> Process injection incidents hunting or ignore lists becoming sheer nightmare with dozens of NOT LIKE NOT LIKE Is there any way to load sqlite files without need to write own extension

slevchenko · Answer

Can that be introduced as a feature I know there s a curl table which as I understood allows to load data from some remote source

fritz · Answer

< slevchenko> you can utilize cte lookup tables to avoid the `NOT LIKE AND NOT LIKE AND NOT LIKE`

slevchenko · Answer

Yup that s what I m doing now but queries become huge

fritz · Answer

If you want to share a snippet of your query I can give it some eyes and see if there is an opportunity for reducing some of the verbosity Happy to do so in thread or in DM

slevchenko · Answer

I hoped in to use `NOT IN table name` but that works either with exising tables or extensions

seph · Answer

If you have a SQLite file on disk you can load it as a table It s in the config file Look for docs or blog posts about ATC tables

slevchenko · Answer

I have no file just yet but I ll create it for this purpose

fritz · Answer

< seph> s ATC recommendation is definitely a good approach the only difficulty is ensuring the file exists on disk and is kept up to date

slevchenko · Answer

I m creating a daemon which will control its synchronization

seph · Answer

Understood you asked it it could be added and it s already there Mostly pricing background Only real caveat is that you d need to manage the contents of it out of band

slevchenko · Answer

Yes if it s already there it s just fantastic Just what I needed

fritz · Answer

if you can handle ensuring the sqlite file db exists on disk and is kept up to date ATC is definitely the right path

fritz · Answer

slevchenko · Answer

slevchenko · Answer

Aha Thanks folks that saves me hell load of time

fritz · Answer

+1

fritz · Answer

ATC is amazing < obelisk> is a legend for adding that capability

slevchenko · Answer

So just to share why I need so many conditions I m whitelisting shared library objects to detect those which might be PUA

slevchenko · Answer

and that becomes a pain in a back without an ability to group objects into a table

fritz · Answer

There are methods for doing this sort of thing all within the query in a way that s reasonably sized

fritz · Answer

if you provide an example of 2 or 3 of your conditions i can show you the approach i take when doing this within query vs referencing an external source file

slevchenko · Answer

sure moment

slevchenko · Answer

```SELECT process memory map pid as mpid from process memory map LEFT JOIN processes USING pid WHERE process memory map path LIKE and process memory map pseudo = 1 AND process memory map path NOT LIKE lib AND process memory map path NOT LIKE usr lib AND process memory map path NOT LIKE snap AND process memory map path NOT LIKE usr local lib AND process memory map path NOT LIKE home snap AND process memory map path NOT LIKE var lib snapd AND process memory map path NOT LIKE opt bitnami AND process memory map path NOT LIKE opt java AND process memory map path NOT LIKE opt java AND process memory map path NOT LIKE usr glibc compat AND process memory map path NOT LIKE run user 1000 AND process memory map path NOT LIKE memfd glXXXXXX AND process memory map path = processes path AND process memory map permissions LIKE x ```

slevchenko · Answer

It actually works apart from the fact that it s a sheer pain to read slightly smiling face

seph · Answer

Yeah I feel like I ve been somewhat annoyed that there s no `LIKE IN ` structure

seph · Answer

Oh I see you have ` ` in those LIKEs That s not going to do what you think ` ` is an osquery construct not a sql one So in a SQL comparison it s the same as a single ` ` and it will match anything slack or not

seph · Answer

If you want to get really fancy you could probably use the osquery regex routines

slevchenko · Answer

Thanks I ll try that too right after custom sql tables