Leveraging osquery for effective Incident Response as well as stealthy enumeration

No ratings

Presented at BSidesAthens 2019 by

Dimitrios Bougioukas

This talk is oriented towards both Blue team and Red team members (a.k.a Purple Team talk). osquery is an open source solution that can extend a Blue team's endpoint visibility, in an efficient and centralized manner. It does so by exposing operating system configuration data in the form of relational database tables. All Blue team members have to do is submit or schedule queries against these tables to collect valuable data about the current state of an endpoint/server as well as changes performed on it over time. The great thing about Osquery (especially when deployed on a Windows environment) is that it provides detailed insight into the registry, WMI, hardware events and many other areas that were previously disregarded by other endpoint monitoring agents or could not be interrogated though a single endpoint monitoring solution.During this talk, Blue team members will learn how to detect modern attacks leveraging osquery's capabilities. Specifically, fileless malware, ransomware, malicious browser extensions and a variety of post-exploitation actions will be detected during a live demonstration, through osquery.Some of osquery's insufficiently secure libraries and common deployment shortcomings can be leveraged by attackers to perform stealthy enumeration. During this talk,Red team members will learn how to perform osquery injections and leverage deployment misconfigurations in order to perform stealthy enumeration or even detailed reconnaissance. In addition, tips on how to evade osquery by tampering with a system's kernel will also be presented to the audience.