osquery-defense-kit
Production-ready detection & response queries for osquery
File Explorer
Download Latest Version (.zip)- actionlint.yaml
- ci.yml
- zizmor.yaml
- mergify.yml
- zizmor.yml
- 1-unexpected-dns-traffic-events.sql
- 1-unexpected-dns-traffic.sql
- 1-unexpected-https-linux.sql
- 1-unexpected-https-macos.sql
- 1-unexpected-talker-events.sql
- 1-unexpected-talkers-linux.sql
- 1-unexpected-talkers-macos.sql
- 2-unexpected-icmp-socket-events.sql
- 2-unexpected-icmp-socket.sql
- 2-unexpected-root-libcurl-proc-linux.sql
- 3-unexpected-root-libcurl-proc-macos.sql
- 1-high-disk-bytes-written.sql
- 2-excess-google-drive-downloads-macos.sql
- 2-excess-google-drive-folder-exports-macos.sql
- 2-spotlight-database-export-macos.sql
- 1-unexpected-dev-opener-linux.sql
- 1-unexpected-dev-opener-macos.sql
- 2-macos_keyboard_sniffer.sql
- 2-unexpected-sensitive-file-access-linux.sql
- 2-unexpected-sensitive-file-access-macos.sql
- 3-yara-mounted-stealer.sql
- 1-unexpected-netutil-calls-linux.sql
- 1-unexpected-netutil-calls-macos.sql
- 2-unexpected-bpf-user.sql
- 2-unexpected-pcap-user-linux.sql
- 2-unexpected-pcap-user-macos.sql
- 0-touched-executable-linux.sql
- 1-empty_root_environ_linux.sql
- 1-empty_root_environ_macos.sql
- 1-hidden-cwd.sql
- 1-hidden-home-libappsupport.sql
- 1-missing-from-disk-linux.sql
- 1-missing-from-disk-macos.sql
- 1-old-binaries-running.sql
- 1-touched-executable-macos.sql
- 1-unexpected-alf-exceptions-macos.sql
- 1-unexpected-etc-executables.sql
- 1-unexpected-ld-so-files-linux.sql
- 1-unexpected-process-extension-linux.sql
- 1-unexpected-tmp-executables-linux.sql
- 1-unexpected-tmp-executables-macos.sql
- 1-unexpected-var-run-linux.sql
- 1-unusual-executable-name-linux.sql
- 1-unusual-executable-name-macos.sql
- 1-unusual-process-name-linux.sql
- 1-unusual-process-name-macos.sql
- 2-executables-from-the-future.sql
- 2-hidden-cwd-events-linux.sql
- 2-hidden-executable.sql
- 2-hidden-home-config-dir.sql
- 2-hidden-home-library-dir.sql
- 2-name_path_mismatch.sql
- 2-parent-missing-from-disk-linux.sql
- 2-parent-missing-from-disk-macos.sql
- 2-ssh-notty.sql
- 2-unexpected-dev-entries.sql
- 2-unexpected-hidden-system-paths.sql
- 2-unexpected-kernel-extensions-macos.sql
- 2-unexpected-kernel-modules-linux.sql
- 2-unexpected-library-entries-macos.sql
- 2-unexpected-public-files_macos.sql
- 2-unexpected-user-executables-macos.sql
- 2-unexpected-user-shared-entries.sql
- 2-unexpected-var-executables-linux.sql
- 2-unexpected-var-run-macos.sql
- 2-unusually-tainted-kernel-linux.sql
- 3-hidden-launchd-files-macos.sql
- 3-overwritten-memory-map-ddexec-linux.sql
- 3-parent-pid-missing-from-procfs.sql
- 3-pid-hidden-by-rootkit.sql
- 3-unexpected-dev-executables-linux.sql
- 3-unexpected-var-executables-macos.sql
- 1-exotic-command-events-linux.sql
- 1-exotic-command-events-macos.sql
- 1-exotic-commands-linux.sql
- 1-exotic-commands-macos.sql
- 1-recently-created-executables-long-lived-linux.sql
- 1-recently-created-executables-long-lived-macos.sql
- 1-sketchy-fetcher-events.sql
- 1-sketchy-fetcher.sql
- 1-tiny-executable-events.sql
- 1-unexpected-env-values-linux.sql
- 1-unexpected-execdir-linux.sql
- 1-unexpected-execdir-macos.sql
- 1-unexpected-executable-permissions.sql
- 1-unexpected-fetcher-parent-events.sql
- 1-unexpected-fetcher-parents.sql
- 1-unexpected-gatekeeper-approvals-macos.sql
- 1-unexpected-osascript-calls.sql
- 1-unexpected-setuid-binaries.sql
- 1-unexpected-sysutils-linux.sql
- 1-unexpected-sysutils-macos.sql
- 1-unexpected-xattr-calls-macos.sql
- 2-exec-failed-launch-constraint-violation.sql
- 2-tiny-executable.sql
- 2-unexpected-chmod-exec-event-linux.sql
- 2-unexpected-chmod-exec-event-macos.sql
- 2-unexpected-env-values-macos.sql
- 2-unexpected-execdir-events-linux.sql
- 2-unexpected-execdir-events-macos.sql
- 2-unexpected-long-running-security-framework-macos.sql
- 2-unexpected-packet-sniffer.sql
- 2-unexpected-root-signer-events-macos.sql
- 3-relative-exec-low-uid-events.sql
- 3-relative-exec-low-uid.sql
- 3-reverse-shell-socket.sql
- 3-unexpected-mounts.sql
- 3-xprotect-reports.sql
- 3-yara-unexpected-miner-process.sql
- 3-yara-unexpected-upx-process.sql
- 0-salesforce-large-download-generic.sql
- 0-salesforce-large-download-spotlight.sql
- 1-high_disk_bytes_read.sql
- 2-yara-exec-connect-process-linux.sql
- 3-yara-unexpected-rust-http-exec-process.sql
- 1-evenly-timestomped.sql
- 1-unexpected-etc-hosts.sql
- 1-unexpected-diskimage-source-macos.sql
- 1-unexpected-shell-parent-events.sql
- 1-unexpected-shell-parents.sql
- 1-unexpected-webmail-downloads.sql
- 2-sketchy-download-name.sql
- 2-sketchy-mounted-diskimage.sql
- 2-unexpected-diskimage-name-macos.sql
- 2-unexpected-volume-contents.sql
- 3-yara-recently-downloaded-miner.sql
- 3-yara-recently-downloaded-packed.sql
- 3-yara-recently-downloaded-ransom.sql
- 3-yara-recently-downloaded-stealer.sql
- 1-unexpected-active-systemd-units.sql
- 1-unexpected-chrome-extensions.sql
- 1-unexpected-device-linux.sql
- 1-unexpected-global-lock.sql
- 1-unexpected-listening-port-linux.sql
- 1-unexpected-systemctl-calls-linux.sql
- 1-unexpected-uid0-daemon-linux.sql
- 2-listening-from-unusual-location.sql
- 2-low-fd-socket.sql
- 2-minimal-socket-client-linux.sql
- 2-minimal-socket-client-macos.sql
- 2-shady-chrome-extension-author.sql
- 2-suspicious-systemd-unit.sql
- 2-unexpected-cron-entries.sql
- 2-unexpected-launchd-program-arguments.sql
- 2-unexpected-launchd-program-macos.sql
- 2-unexpected-listening-port-macos.sql
- 2-unexpected-lock-opener.sql
- 2-unexpected-uid0-daemon-macos.sql
- 3-fake-apple-launchd.sql
- 3-suspicious-udev-runner-linux.sql
- 3-unexpected-ssh-authorized-keys.sql
- 3-yara-libtomcrypt-process.sql
- 3-yara-suspicious-strings-process-linux.sql
- 1-setxid-env-overflow-attempt.sql
- 1-unexpected-privileged-containers.sql
- 1-unexpected-setxid-process.sql
- 2-docker-container-mounting-root.sql
- 2-setxid-cmdline-overflow-attempt.sql
- 2-unexpected-elevated-children-events_linux.sql
- 2-unexpected-elevated-children-events_macos.sql
- 2-unexpected-privilege-escalation_linux.sql
- 2-unexpected-privilege-escalation_macos.sql
- 3-sketchy-docker-image-creator.sql
- process_event_parents.sql
- process_event_parents_macos.sql
- process_parents.sql
- process_parents_macos.sql
- README.md
- logo-small.png
- logo.png
- account_policy_data-macos.sql
- alf.sql
- alf_exceptions_macos.sql
- alf_explicit_auths_macos.sql
- alf_services.sql
- app_schemes.sql
- apps.sql
- authorization_mechanisms-macos.sql
- authorizations-macos.sql
- authorized_keys.sql
- block_devices.sql
- certificates.sql
- chrome_extension_content_scripts.sql
- chrome_extensions.sql
- crashes-macos.sql
- crontab.sql
- deb_packages.sql
- disk_encryption.sql
- disk_events_macos.sql
- dns_resolvers.sql
- docker_container_mounts.sql
- docker_container_ports.sql
- docker_container_processes.sql
- docker_containers.sql
- docker_image_history.sql
- docker_images.sql
- es_process_events.sql
- etc_hosts.sql
- event_taps_macos.sql
- file_events.sql
- files-dev.sql
- files-downloads.sql
- files-etc.sql
- files-recently-written.sql
- firefox_addons.sql
- gatekeeper_approved_apps_macos.sql
- groups.sql
- hardware_events.sql
- homebrew-packages-macos.sql
- interface_addresses.sql
- interface_details.sql
- interface_ipv6.sql
- iokit-registry-macos.sql
- ip_forwarding.sql
- iptables.sql
- kernel_info.sql
- kernel_modules_linux.sql
- kernel_panics-macos.sql
- kextstat_macos.sql
- known_hosts.sql
- last.sql
- launchd_macos.sql
- launchd_overrides_macos.sql
- listening_ports.sql
- logged_in_users.sql
- loginwindow1.sql
- loginwindow2.sql
- loginwindow3.sql
- loginwindow4.sql
- memory_map.sql
- mounts.sql
- npm_packages.sql
- nvram-macos.sql
- open_files.sql
- open_sockets.sql
- os_version.sql
- package_install_history_macos.sql
- package_receipts_macos.sql
- platform_info.sql
- preferences_macos.sql
- process_env.sql
- process_events.sql
- process_memory_map.sql
- process_open_files.sql
- process_open_pipes.sql
- process_open_sockets.sql
- processes.sql
- README.md
- recent_items_macos.sql
- rpm_packages.sql
- running_apps_macos.sql
- safari_extensions_macos.sql
- sandboxes_macos.sql
- seccomp_events.sql
- selinux_events.sql
- shadow.sql
- shared_memory.sql
- shell_history.sql
- sip_config.sql
- socket_events.sql
- ssh_configs.sql
- startup_items.sql
- suid_bin.sql
- syslog_events.sql
- system_controls.sql
- systemd_units.sql
- unified_log_macos.sql
- usb_devices.sql
- user_events.sql
- user_ssh_keys.sql
- users.sql
- xprotect_reports.sql
- gcp-service-account-keys-mdfind.sql
- gcp-service-account-keys.sql
- unexpected-rsa-keys-mdfind.sql
- unexpected-rsa-keys.sql
- unusually-long-uptime-likely-missing-patches.sql
- 2-vulnerable-acrobat-reader.sql
- .gitignore
- LICENSE.txt
- Makefile
- osquery.conf
- README.md
# Installation Guide
1. Get the code
git clone https://github.com/chainguard-dev/osquery-defense-kit
Downloads the entire project code from GitHub to your computer.
cd osquery-defense-kit
Moves into the project folder you just downloaded.
2. Make
Medium RecommendedPrerequisites
- Git Needed to download the project code from GitHub.
- Make Usually pre-installed on Linux/macOS. On Windows, install separately (e.g. via MSYS2 or WSL).
make
Compiles the code based on the generated build configuration to produce an executable.
If it finishes without errors, it worked. Try running the generated executable directly.
// repository documentation
Was this content helpful?
(0 ratings)