Good Morning. When looking in the extension log I can see references to a cert and attempted connections to a management server. Can this be disabled as we are not using that functionality of this extension.

can you share extension log file and point to the logs for attempted server connection? location:

<programfiles>\plgx_osquery\

Or maybe the specific lines?

the line is

plgx_tls.cpp:192: tls_server_certs is: \Program Files\osquery\certs\cert.pem

When I navigate to that directory there is a cert there which I did not install. If I monitor the socket connections (using the extension itself) I can see attempted connections with these 4 IP addresses in the past 48 hours:

208.111.179.129
72.21.81.240
8.253.38.248
104.18.20.226

when you install osquery via its msi installer, a default pem file is installed by osquery. this is the same file

\Program Files\osquery\certs\cert.pem

. extension just enumerates certain osquery flags including

tls_server_certs

when it is launched but doesn't try to make any connection to any server. for osquery\extension to communicate to a server,

tls_hostname

has to be provided in osquery.flags file. since the default flags provided with extension dont have any server related flag, it wont attempt to connect to any server.

@lvferdi, is your osquery manage thru TLS? The extension uses osquery APIs to read osquery flags. This could force osquery's config plug-in to fetch the config. If the config is TLS, it could force a network connection. Other than than, extension doesn't do any socket activity.

no it is not managed via TLS server and the connections are from the extension I am running wireshark to capture it now

Interesting. What destination port are these connections on? Let me spin up an instance and see if we get any such activity..The best I can think of is some internal library in osquery SDK..but well, will get back with some debugs

There is a disabled defender and Sysmon and osquery on this box, that is it. I will grab the ports momentarily

can you confirm if it is reproducible on an another vanilla vm having no other security software or tool? (defender being installed and enabled is ok)

@lvferdi, 1. Do you have SSL events enabled? 2. I believe these lookups are going outbound for Certificate validations/ checking CRLs. The extension using Windows APIs for certificate validations in image_load_events and ssl events. The IP address you mentioned is a Cloudflare IP and has been used to host [https://ocsp2.globalsign.com/] as shown in the VirusTotal reputation of the URL. https://www.virustotal.com/gui/url/83102acd5700e6a7d644f55899b098261b6972ccde6ead25a4d0cfda00b7520c/details Final URLhttps://www.globalsign.com/en/ Serving IP Address104.18.21.226

I do have ssl enabled that makes sense, I will confirm with my pcap today. Thank you

as @OpenPlgx also mentioned, image load events can also trigger these lookups