OSQUERY - Exercise No. 1

“consider JOINing against the users table”
osquery> select * from shell_history WHERE shell_history.uid IN (SELECT uid from users);

Who has stored the SSH private keys on the machine?
osquery> select * from shell_history WHERE shell_history.uid IN (SELECT uid from users) and shell_history.command like '%rsa%';

The path of the ftp service daemon running.
osquery> select path from  processes where name='vsftpd';

The complete path of a specific binary run as root.
osquery> select * from shell_history WHERE shell_history.uid IN (SELECT uid from users) and shell_history.command like '%sudo%';

Sources:
https://www.attackdefense.com
https://www.first.org/resources/papers/conf2018/Wilson-Doug_FIRST_20180629.pdf

OSQUERY - Networking Tables

How many network interfaces are present on the machine?
osquery> select * from interface_addresses;

How many DNS servers are configured on the machine?
osquery> select * from dns_resolvers;

208.67.222.222 belongs to OpenDNS.

Which interface is acting as the default gateway for the machine?
osquery> select * from routes;

How many entries are there in the ARP cache?
osquery> select * from arp_cache;

What is the given hostname of the machine?
osquery> select * from etc_hosts;

Source:https://www.attackdefense.com/challengedetails?cid=1044