https://github.com/osquery/osquery
Basis
osqueryi
Enter Osquery console.
.help
Show help..version
Show version
.tables
List all available tables..schema [TABLE_NAME]
Display schema of the table.
.tables [TABLE_NAME]
Display table content.
Tables Examples
.tables processes
Processes table.SELECT * FROM kernel_info;
Kernel Info table.SELECT * FROM shell_history;
Shell history table.
Query Examples (SQL like)
SELECT * FROM processes;
SELECT pid, name, path FROM processes;
SELECT count(*) from processes;
SELECT pid, name, path FROM processes WHERE name='lsass.exe';
WHERE Operators & Wildcards
=
Equal.<>
Not Equal.>
Greater than.>=
Greater than or equal to.<
Less than.<=
Less than or equal to.
BETWEEN
Between a range.LIKE
Pattern wildcard searches.%
Multiple characters wildcard._
One character wildcard.
With YARA
https://osquery.readthedocs.io/en/stable/deployment/yara/
SELECT * FROM yara WHERE path LIKE '/home/%%' AND sigfile='/var/osquery/yara/scanner.yara';
Execute Yara scan on all files returned by Osquery.
