Great query @Guillaume! https://twitter.com/gepeto42/status/1128383095428743172

❤️ that you called out the 172/12 issue there

Figured it was good enough for a quick query for most but at the same time I dislike articles that assume 172.16 to be a :16 :)

@Guillaume Updated for

os_version

check (<= Windows 2008 R2) https://gist.github.com/defensivedepth/7a8a4f804818ca18c8ce46f8e0a8c5fd

@defensivedepth would looking for os_version.version < 6.2 make more sense though?

@Guillaume Yes it would, except that

version

is a

text

datatype and

< 6.2

won't work. Alternatively, I think the following would catch everything 2008 R2 / Win 7 & below:

WHERE major < 7 AND minor < 2

Is

remote_address

the… remote_address? Is this RDP things with a remote connection, not things that are listening?

Basically as soon as someone connects to you over the internet you'll see it @seph, considering how everything I ever put on the internet constantly receives connections over RDP I think it's sensible

hahahaha. Fair enough. Leveraging the constant scans as a canary mechanism

Yep

@Guillaume Curious to hear how often you schedule this query in prod?

I think it really does not have to be frequent. The idea here is that there's constant connections, and you weed them out over time. 60m?

Ya, I dont have osquery on XP in my env, so I couldnt test that 🙂

Saved by lack of legacy support 😄

It’s an event table. So query frequency may not mean what you think.

Honestly, I thought of it as a query I would run once to spot problems more than anything but yeah you're right

blah. You’re right. It’s not evented. I dunno what query I saw that was.

socket_events is not supported on Windows 😞