Unexpected Mounts
osquery
Detect weird mounts, like mounting the EFI partition
Description
ODK (osquery-defense-kit) is unique in that the queries are designed to be used as part of a production detection & response pipeline. The detection queries are formulated to return zero rows during normal expected behavior, so that they may be configured to generate alerts when rows are returned.
Query
-- Detect weird mounts, like mounting the EFI partition
--
-- references:
-- * https://www.welivesecurity.com/2022/07/19/i-see-what-you-did-there-look-cloudmensis-macos-spyware/
--
-- platform: darwin
-- tags: transient filesystem state
SELECT
*
FROM
mounts
WHERE
device = '/dev/disk0s1'
AND type = 'msdos';tags: SStagSS