Leveraging Osquery for DFIR at Scale
summary
Claims that OSQuery can fast‑track DFIR by collecting live artifacts at scale: process execution, command lines, open sockets, loaded DLLs and file mtimes, plus new user accounts and Docker misconfigurations. Demonstrates detecting Meterpreter-like beacons (PowerShell outbound on port 444), DLL injection into notepad/calc, credential‑based crypto miners from GitHub commits, and auditing privileged containers. Uses osquery agent with query packs and a collide fleet TLS endpoint, leveraging process and process_open_sockets joins to capture PIDs, commands, network peers and file metadata for rapid triage.
AI-written summary · about
chapters (8)
- 0:00Start
- 0:23Agenda
- 2:33Background on Os Query
- 6:17Query Deployment Architecture
- 12:47Crypto Mining
- 14:42Container Exploit Attempts
- 15:37Container Forensics
- 17:03Outlier Analysis
related talks
27mThou Shalt Query: Compliance Ideas with Osquery
40mBeyond Endpoint Security Using Osquery at Scale
22mIntrospecting your machines with osquery
22mUsing osquery as an SSH replacement for remote host investigation
46m2014.10.29 - Security@Scale - Mike Arpaia, Facebook
27mBreach - ATT&CK - Osquery
32mA Case Study of MacOS Supply Chain Compromise
19mSecuring the endpoint with open software