Welcome to OS Analysis with osquery.
My name is Joe Abraham. And in this course,
we're going to see how you can secure your hosts better using osquery.
More specifically,
we'll dive into how you can use osquery to detect specific
techniques in our operating systems today.
Osquery is a tool that was created to expose our operating systems as high
performance relational databases for whatever purposes we need.
You can write SQL queries to explore the data relevant to the OS.
The tables themselves contain all of the data for
things such as the running processes, network connections,
applications, kernel modules, and many more things.
Osquery allows us to audit several components of our operating systems.
And using its capabilities,
we can do things like track file movements or changes,
understand processes and their individual connections,
and identify system commands that are occurring.
Osquery is a free tool that you can download.
And unless you want to get deep into the SQL query language and how it operates,
it's relatively easy to pick up.
That means no, you don't have to know SQL to be able to use it effectively.
Of course, it helps a bit.
But for our use cases, it's not really necessary.
It uses extensions and plugins to help increase its usability,
and several popular tools have the ability to interact with it.
We can use it for monitoring, detection, and forensic use cases.
Oh, and it has some API capabilities as well.
If we look at the NIST cybersecurity framework,
which shows five different functions,
we can safely say that osquery is in line with at least two or three of them.
The first one that we'll talk about is protect.
It would be protect because it helps us with some identity
management and data security as we can see who and what
modified the operating system components,
files, and users.
The other one is detect since we're using it to
monitor the OS for potential threats.
For the purposes of this course,
we'll be focusing on protect and seeing what the visibility within it provides.
A lot of the functionality of osquery, at least at its core,
centers around the data security and visibility piece.
We can use it for auditing purposes,
tracking process creation and communications,
as well as many other OS‑specific actions.
Auditing is definitely a good way to put it with all of
the information that it provides.
If we look at identity management as an example,
osquery will help you make sure that you cover PR.AC‑1:
Identities and credentials are issued, managed,
verified, revoked, and audited for authorized devices,
users,
and processes. And we'll do this in a very particular
way to align with another framework.
It'll also let you fulfill PR.DS‑5: Protections
against data leaks are implemented, which is in that data security category.
Since we're using that audit word,
it'll do that by making sure that our pocket litter files are tracked properly.
If we look at this tool from the perspective of the MITRE ATT&CK framework,
we see that it allows us to gather and see operating system information,
which would classify it in the OS analysis data type.
Now, it can also be considered file analysis as well in some ways.
Both of these classifications depend on what additional
extensions and packages we install.
For the purposes of this course, we'll focus on the OS analysis piece,
hence the name.
It'll help us prevent attacks using the following
techniques from being executed, like the T1136,
create account technique, or the T1074, data staged technique.
Now,
we can break this tool's mappings down even further in the MITRE
classifications by using MITRE SHIELD. The defense techniques are what we'll
be demonstrating throughout this course for prevention of the TTPs that
we're mapping them to from the attack framework.
So, we'll be doing things like detecting user accounts that are
created outside of the acceptable process.
We'll also use it to stage and track a variety of files around the network and
create detections for them being moved or copied, almost like honeypot files. In
an enterprise environment, we have workstations,
servers, and all of the services that they're using or providing typically
scattered in multiple places. For the purposes of this course, we'll say
that osquery is here monitoring our Linux systems.
We have our security suite of management tools that we can
use to analyze a lot of this information,
which is the Elastic Stack. Specifically,
we'll use Filebeat and its osquery module,
Elasticsearch, and Kibana.
So, what we're going to end up doing in this course is installing and
configuring this tool to log some of the activities in the operating
system that we're looking for and using that information gained to
validate that it can, in fact, detect when the files are changed and
users are created improperly.
We'll see how we can use osquery and Kibana to help
us accomplish our goals here.
The first step is to get osquery installed and ready to go. Let's get to it.