Open_files

Retrieves all the open files per process in the target system.

Description

ODK (osquery-defense-kit) is unique in that the queries are designed to be used as part of a production detection & response pipeline. The detection queries are formulated to return zero rows during normal expected behavior, so that they may be configured to generate alerts when rows are returned.

Query

-- Retrieves all the open files per process in the target system.
--
-- tags: postmortem
-- platform: posix
SELECT DISTINCT
  pof.pid,
  pof.path,
  pof.fd,
  p.name,
  p.start_time,
  p.euid,
  p.parent,
  p.uid,
  p.cmdline
FROM
  process_open_files pof
  LEFT JOIN processes p ON pof.pid = p.pid
WHERE
  pof.path NOT LIKE '/private/var/folders%'
  AND pof.path NOT LIKE '/System/Library/%'
  AND pof.path NOT IN ('/dev/null', '/dev/urandom', '/dev/random');

tags: SStagSS

Reference

https://github.com/chainguard-dev/osquery-defense-kit