osquery-defense-kit Make a `socket_events` port of `unexpected-https-client-linux`

Make a `socket_events` port of `unexpected-https-client-linux`

Open tstromberg opened this issue 3 years ago • 1 comments

Detection will be less racy on machines with eventing enabled.

Oct 21 '22 17:10 tstromberg

See the currently ported queries as a template to use:

https://github.com/chainguard-dev/osquery-defense-kit/blob/main/detection/c2/unexpected-icmp-socket-events.sql
https://github.com/chainguard-dev/osquery-defense-kit/blob/main/detection/c2/unexpected-dns-traffic-events.sql

Oct 21 '22 17:10 tstromberg