2020-08-11 20:46:54 +00:00
|
|
|
# Copyright (c) 2014-present, The osquery authors
|
2018-11-30 01:27:21 +00:00
|
|
|
#
|
2020-08-11 20:46:54 +00:00
|
|
|
# This source code is licensed as defined by the LICENSE file found in the
|
|
|
|
|
# root directory of this source tree.
|
|
|
|
|
#
|
|
|
|
|
# SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
|
2018-11-30 01:27:21 +00:00
|
|
|
|
|
|
|
|
function(specsMain)
|
2019-06-25 08:50:43 +00:00
|
|
|
add_osquery_library(specs_tables INTERFACE)
|
2018-11-30 01:27:21 +00:00
|
|
|
|
2019-06-25 08:50:43 +00:00
|
|
|
generateNativeTables()
|
|
|
|
|
list(APPEND table_target_list "${generateNativeTables_output}")
|
2018-11-30 01:27:21 +00:00
|
|
|
|
2019-06-25 08:50:43 +00:00
|
|
|
generateForeignTables(${foreign_spec_file_list_output})
|
2018-11-30 01:27:21 +00:00
|
|
|
list(APPEND table_target_list "${generateForeignTables_output}")
|
|
|
|
|
|
|
|
|
|
foreach(table_target ${table_target_list})
|
2019-06-25 08:50:43 +00:00
|
|
|
target_link_libraries("${table_target}" PUBLIC osquery_tables_tableimplementations)
|
2018-11-30 01:27:21 +00:00
|
|
|
enableLinkWholeArchive("${table_target}")
|
|
|
|
|
endforeach()
|
|
|
|
|
|
|
|
|
|
target_link_libraries(specs_tables INTERFACE ${table_target_list})
|
2019-11-07 13:32:14 +00:00
|
|
|
|
|
|
|
|
generateCopyFileTarget("specs_table_files" "" "REGEX" "*.table" "${TEST_CONFIGS_DIR}/specs")
|
2018-11-30 01:27:21 +00:00
|
|
|
endfunction()
|
|
|
|
|
|
2019-06-25 08:50:43 +00:00
|
|
|
function(generateForeignTables spec_file_list)
|
|
|
|
|
generateTableCategoryAmalgamation("foreign" ${spec_file_list})
|
|
|
|
|
set(generateForeignTables_output "${generateTableCategoryAmalgamation_output}" PARENT_SCOPE)
|
|
|
|
|
endfunction()
|
|
|
|
|
|
|
|
|
|
function(generateNativeTables)
|
|
|
|
|
set(platform_independent_spec_files
|
2020-06-25 13:10:17 +00:00
|
|
|
azure_instance_metadata.table
|
|
|
|
|
azure_instance_tags.table
|
2018-11-30 01:27:21 +00:00
|
|
|
carbon_black_info.table
|
|
|
|
|
carves.table
|
|
|
|
|
chrome_extensions.table
|
2020-02-21 23:13:41 +00:00
|
|
|
chrome_extension_content_scripts.table
|
2018-11-30 01:27:21 +00:00
|
|
|
curl.table
|
|
|
|
|
curl_certificate.table
|
|
|
|
|
etc_hosts.table
|
|
|
|
|
etc_protocols.table
|
|
|
|
|
etc_services.table
|
|
|
|
|
groups.table
|
2020-02-05 20:11:08 +00:00
|
|
|
firefox_addons.table
|
2018-11-30 01:27:21 +00:00
|
|
|
hash.table
|
|
|
|
|
interface_addresses.table
|
|
|
|
|
interface_details.table
|
|
|
|
|
listening_ports.table
|
|
|
|
|
logged_in_users.table
|
|
|
|
|
os_version.table
|
|
|
|
|
platform_info.table
|
|
|
|
|
process_memory_map.table
|
|
|
|
|
process_open_sockets.table
|
|
|
|
|
processes.table
|
|
|
|
|
python_packages.table
|
|
|
|
|
routes.table
|
2020-02-05 20:13:55 +00:00
|
|
|
ssh_configs.table
|
2020-11-23 06:37:55 +00:00
|
|
|
startup_items.table
|
2018-11-30 01:27:21 +00:00
|
|
|
system_info.table
|
|
|
|
|
uptime.table
|
2020-02-05 20:13:55 +00:00
|
|
|
user_ssh_keys.table
|
2018-11-30 01:27:21 +00:00
|
|
|
users.table
|
|
|
|
|
utility/file.table
|
|
|
|
|
utility/osquery_events.table
|
|
|
|
|
utility/osquery_extensions.table
|
|
|
|
|
utility/osquery_flags.table
|
|
|
|
|
utility/osquery_info.table
|
|
|
|
|
utility/osquery_packs.table
|
|
|
|
|
utility/osquery_registry.table
|
|
|
|
|
utility/osquery_schedule.table
|
|
|
|
|
utility/time.table
|
2021-02-26 23:44:20 +00:00
|
|
|
ycloud_instance_metadata.table
|
2018-11-30 01:27:21 +00:00
|
|
|
)
|
|
|
|
|
|
2020-08-26 04:03:30 +00:00
|
|
|
if(TARGET_PROCESSOR STREQUAL "x86_64")
|
|
|
|
|
list(APPEND platform_independent_spec_files cpuid.table)
|
|
|
|
|
endif()
|
|
|
|
|
|
2019-06-25 08:50:43 +00:00
|
|
|
set(platform_dependent_spec_files
|
2018-11-30 01:27:21 +00:00
|
|
|
"arp_cache.table:linux,macos,windows"
|
2020-09-18 20:06:01 +00:00
|
|
|
"atom_packages.table:linux,macos,windows"
|
2018-11-30 01:27:21 +00:00
|
|
|
"darwin/account_policy_data.table:macos"
|
|
|
|
|
"darwin/ad_config.table:macos"
|
|
|
|
|
"darwin/alf.table:macos"
|
|
|
|
|
"darwin/alf_exceptions.table:macos"
|
|
|
|
|
"darwin/alf_explicit_auths.table:macos"
|
|
|
|
|
"darwin/app_schemes.table:macos"
|
|
|
|
|
"darwin/apps.table:macos"
|
|
|
|
|
"darwin/asl.table:macos"
|
|
|
|
|
"darwin/authorization_mechanisms.table:macos"
|
|
|
|
|
"darwin/authorizations.table:macos"
|
|
|
|
|
"darwin/battery.table:macos"
|
|
|
|
|
"darwin/browser_plugins.table:macos"
|
|
|
|
|
"darwin/crashes.table:macos"
|
|
|
|
|
"darwin/cups_destinations.table:macos"
|
|
|
|
|
"darwin/cups_jobs.table:macos"
|
|
|
|
|
"darwin/device_firmware.table:macos"
|
|
|
|
|
"darwin/disk_events.table:macos"
|
|
|
|
|
"darwin/event_taps.table:macos"
|
|
|
|
|
"darwin/fan_speed_sensors.table:macos"
|
|
|
|
|
"darwin/gatekeeper.table:macos"
|
|
|
|
|
"darwin/gatekeeper_approved_apps.table:macos"
|
|
|
|
|
"darwin/homebrew_packages.table:macos"
|
2019-08-19 21:41:24 +00:00
|
|
|
"darwin/ibridge_info.table:macos"
|
2018-11-30 01:27:21 +00:00
|
|
|
"darwin/iokit_devicetree.table:macos"
|
|
|
|
|
"darwin/iokit_registry.table:macos"
|
|
|
|
|
"darwin/kernel_extensions.table:macos"
|
|
|
|
|
"darwin/kernel_panics.table:macos"
|
|
|
|
|
"darwin/keychain_acls.table:macos"
|
|
|
|
|
"darwin/keychain_items.table:macos"
|
|
|
|
|
"darwin/launchd.table:macos"
|
|
|
|
|
"darwin/launchd_overrides.table:macos"
|
2020-12-21 18:37:31 +00:00
|
|
|
"darwin/location_services.table:macos"
|
2018-11-30 01:27:21 +00:00
|
|
|
"darwin/managed_policies.table:macos"
|
|
|
|
|
"darwin/mdfind.table:macos"
|
2020-02-11 17:15:00 +00:00
|
|
|
"darwin/mdls.table:macos"
|
2018-11-30 01:27:21 +00:00
|
|
|
"darwin/nfs_shares.table:macos"
|
|
|
|
|
"darwin/nvram.table:macos"
|
|
|
|
|
"darwin/package_bom.table:macos"
|
|
|
|
|
"darwin/package_install_history.table:macos"
|
|
|
|
|
"darwin/package_receipts.table:macos"
|
|
|
|
|
"darwin/plist.table:macos"
|
|
|
|
|
"darwin/power_sensors.table:macos"
|
|
|
|
|
"darwin/preferences.table:macos"
|
|
|
|
|
"darwin/quicklook_cache.table:macos"
|
|
|
|
|
"darwin/running_apps.table:macos"
|
|
|
|
|
"darwin/safari_extensions.table:macos"
|
|
|
|
|
"darwin/sandboxes.table:macos"
|
2020-03-16 01:03:16 +00:00
|
|
|
"darwin/screenlock.table:macos"
|
2018-11-30 01:27:21 +00:00
|
|
|
"darwin/shared_folders.table:macos"
|
|
|
|
|
"darwin/sharing_preferences.table:macos"
|
|
|
|
|
"darwin/signature.table:macos"
|
|
|
|
|
"darwin/sip_config.table:macos"
|
|
|
|
|
"darwin/smc_keys.table:macos"
|
2021-01-11 15:34:11 +00:00
|
|
|
"darwin/system_extensions.table:macos"
|
2018-11-30 01:27:21 +00:00
|
|
|
"darwin/temperature_sensors.table:macos"
|
|
|
|
|
"darwin/time_machine_backups.table:macos"
|
|
|
|
|
"darwin/time_machine_destinations.table:macos"
|
|
|
|
|
"darwin/user_interaction_events.table:macos"
|
|
|
|
|
"darwin/virtual_memory_info.table:macos"
|
|
|
|
|
"darwin/wifi_networks.table:macos"
|
|
|
|
|
"darwin/wifi_scan.table:macos"
|
|
|
|
|
"darwin/wifi_status.table:macos"
|
|
|
|
|
"darwin/xprotect_entries.table:macos"
|
|
|
|
|
"darwin/xprotect_meta.table:macos"
|
|
|
|
|
"darwin/xprotect_reports.table:macos"
|
|
|
|
|
"freebsd/fbsd_kmods.table:freebsd"
|
|
|
|
|
"freebsd/pkg_packages.table:freebsd"
|
|
|
|
|
"linux/selinux_events.table:linux"
|
|
|
|
|
"linux/elf_symbols.table:linux"
|
|
|
|
|
"linux/portage_use.table:linux"
|
|
|
|
|
"linux/rpm_package_files.table:linux"
|
|
|
|
|
"linux/shared_memory.table:linux"
|
|
|
|
|
"linux/iptables.table:linux"
|
|
|
|
|
"linux/portage_keywords.table:linux"
|
|
|
|
|
"linux/elf_segments.table:linux"
|
|
|
|
|
"linux/md_devices.table:linux"
|
|
|
|
|
"linux/process_namespaces.table:linux"
|
|
|
|
|
"linux/syslog_events.table:linux"
|
|
|
|
|
"linux/rpm_packages.table:linux"
|
|
|
|
|
"linux/portage_packages.table:linux"
|
|
|
|
|
"linux/process_file_events.table:linux"
|
|
|
|
|
"linux/md_drives.table:linux"
|
|
|
|
|
"linux/npm_packages.table:linux"
|
|
|
|
|
"linux/elf_info.table:linux"
|
|
|
|
|
"linux/md_personalities.table:linux"
|
|
|
|
|
"linux/kernel_modules.table:linux"
|
|
|
|
|
"linux/shadow.table:linux"
|
|
|
|
|
"linux/memory_info.table:linux"
|
|
|
|
|
"linux/msr.table:linux"
|
|
|
|
|
"linux/memory_map.table:linux"
|
|
|
|
|
"linux/elf_dynamic.table:linux"
|
|
|
|
|
"linux/elf_sections.table:linux"
|
2020-01-27 14:03:52 +00:00
|
|
|
"linux/selinux_settings.table:linux"
|
2020-01-29 00:13:08 +00:00
|
|
|
"linux/apparmor_profiles.table:linux"
|
2020-08-30 00:22:03 +00:00
|
|
|
"linux/apparmor_events.table:linux"
|
2020-12-16 15:52:16 +00:00
|
|
|
"linux/systemd_units.table:linux"
|
2018-11-30 01:27:21 +00:00
|
|
|
"linwin/intel_me_info.table:linux,windows"
|
|
|
|
|
"lldpd/lldp_neighbors.table:linux,macos,freebsd"
|
|
|
|
|
"kernel_info.table:linux,macos,windows"
|
|
|
|
|
"macwin/certificates.table:macos,windows"
|
2020-11-24 21:36:56 +00:00
|
|
|
"posix/extended_attributes.table:linux,macos"
|
2018-11-30 01:27:21 +00:00
|
|
|
"posix/acpi_tables.table:linux,macos"
|
|
|
|
|
"posix/apt_sources.table:linux,macos,freebsd"
|
|
|
|
|
"posix/augeas.table:linux,macos,freebsd"
|
|
|
|
|
"posix/authorized_keys.table:linux,macos,freebsd"
|
|
|
|
|
"posix/block_devices.table:linux,macos"
|
|
|
|
|
"posix/cpu_time.table:linux,macos,freebsd"
|
|
|
|
|
"posix/crontab.table:linux,macos,freebsd"
|
|
|
|
|
"posix/disk_encryption.table:linux,macos"
|
|
|
|
|
"posix/dns_resolvers.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_container_labels.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_container_mounts.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_container_networks.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_container_ports.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_container_processes.table:linux,macos,freebsd"
|
2020-02-24 00:00:38 +00:00
|
|
|
"posix/docker_container_fs_changes.table:linux,macos,freebsd"
|
2018-11-30 01:27:21 +00:00
|
|
|
"posix/docker_container_stats.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_containers.table:linux,macos,freebsd"
|
2021-01-11 15:31:20 +00:00
|
|
|
"posix/docker_image_history.table:linux,macos,freebsd"
|
2018-11-30 01:27:21 +00:00
|
|
|
"posix/docker_image_labels.table:linux,macos,freebsd"
|
2020-01-12 06:43:28 +00:00
|
|
|
"posix/docker_image_layers.table:linux,macos,freebsd"
|
2018-11-30 01:27:21 +00:00
|
|
|
"posix/docker_images.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_info.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_network_labels.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_networks.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_version.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_volume_labels.table:linux,macos,freebsd"
|
|
|
|
|
"posix/docker_volumes.table:linux,macos,freebsd"
|
|
|
|
|
"posix/file_events.table:linux,macos"
|
|
|
|
|
"posix/hardware_events.table:linux,macos"
|
|
|
|
|
"posix/interface_ipv6.table:linux,macos,freebsd"
|
|
|
|
|
"posix/known_hosts.table:linux,macos,freebsd"
|
|
|
|
|
"posix/last.table:linux,macos,freebsd"
|
|
|
|
|
"posix/load_average.table:linux,macos,freebsd"
|
2020-03-16 01:02:18 +00:00
|
|
|
"posix/lxd_instances.table:linux"
|
|
|
|
|
"posix/lxd_instance_config.table:linux"
|
|
|
|
|
"posix/lxd_instance_devices.table:linux"
|
|
|
|
|
"posix/lxd_cluster.table:linux"
|
|
|
|
|
"posix/lxd_cluster_members.table:linux"
|
|
|
|
|
"posix/lxd_images.table:linux"
|
|
|
|
|
"posix/lxd_certificates.table:linux"
|
|
|
|
|
"posix/lxd_networks.table:linux"
|
|
|
|
|
"posix/lxd_storage_pools.table:linux"
|
2018-11-30 01:27:21 +00:00
|
|
|
"posix/magic.table:linux,macos,freebsd"
|
|
|
|
|
"posix/memory_array_mapped_addresses.table:linux,macos"
|
|
|
|
|
"posix/memory_arrays.table:linux,macos"
|
|
|
|
|
"posix/memory_device_mapped_addresses.table:linux,macos"
|
|
|
|
|
"posix/memory_devices.table:linux,macos"
|
|
|
|
|
"posix/memory_error_info.table:linux,macos"
|
|
|
|
|
"posix/mounts.table:linux,macos,freebsd"
|
|
|
|
|
"posix/oem_strings.table:linux,macos"
|
|
|
|
|
"posix/pci_devices.table:linux,macos"
|
|
|
|
|
"posix/process_envs.table:linux,macos,freebsd"
|
|
|
|
|
"posix/process_events.table:linux,macos,freebsd"
|
|
|
|
|
"posix/process_open_files.table:linux,macos,freebsd"
|
2020-01-17 01:55:48 +00:00
|
|
|
"posix/process_open_pipes.table:linux"
|
2018-11-30 01:27:21 +00:00
|
|
|
"posix/prometheus_metrics.table:linux,macos,freebsd"
|
|
|
|
|
"posix/shell_history.table:linux,macos,freebsd"
|
|
|
|
|
"posix/smbios_tables.table:linux,macos"
|
2020-03-31 13:38:31 +00:00
|
|
|
"posix/socket_events.table:linux,macos"
|
2018-11-30 01:27:21 +00:00
|
|
|
"posix/sudoers.table:linux,macos,freebsd"
|
|
|
|
|
"posix/suid_bin.table:linux,macos,freebsd"
|
|
|
|
|
"posix/system_controls.table:linux,macos,freebsd"
|
|
|
|
|
"posix/ulimit_info.table:linux,macos,freebsd"
|
|
|
|
|
"posix/usb_devices.table:linux,macos"
|
|
|
|
|
"posix/user_events.table:linux,macos,freebsd"
|
|
|
|
|
"posix/yum_sources.table:linux,macos,freebsd"
|
2020-05-25 16:17:11 +00:00
|
|
|
"sleuthkit/device_file.table:linux,macos,freebsd,windows"
|
|
|
|
|
"sleuthkit/device_hash.table:linux,macos,freebsd,windows"
|
|
|
|
|
"sleuthkit/device_partitions.table:linux,macos,freebsd,windows"
|
2018-11-30 01:27:21 +00:00
|
|
|
"smart/smart_drive_info.table:linux,macos"
|
|
|
|
|
"user_groups.table:linux,macos,windows"
|
2020-09-11 02:20:34 +00:00
|
|
|
"windows/background_activities_moderator.table:windows"
|
2019-06-25 08:50:43 +00:00
|
|
|
"windows/bitlocker_info.table:windows"
|
2020-06-10 21:28:21 +00:00
|
|
|
"windows/chassis_info.table:windows"
|
2019-06-25 08:50:43 +00:00
|
|
|
"windows/logon_sessions.table:windows"
|
2018-11-30 01:27:21 +00:00
|
|
|
"windows/ntfs_acl_permissions.table:windows"
|
2020-12-20 21:04:26 +00:00
|
|
|
"windows/office_mru.table:windows"
|
2018-11-30 01:27:21 +00:00
|
|
|
"windows/scheduled_tasks.table:windows"
|
|
|
|
|
"windows/windows_crashes.table:windows"
|
|
|
|
|
"windows/services.table:windows"
|
|
|
|
|
"windows/kva_speculative_info.table:windows"
|
|
|
|
|
"windows/patches.table:windows"
|
|
|
|
|
"windows/ie_extensions.table:windows"
|
|
|
|
|
"windows/shared_resources.table:windows"
|
|
|
|
|
"windows/wmi_cli_event_consumers.table:windows"
|
|
|
|
|
"windows/video_info.table:windows"
|
|
|
|
|
"windows/registry.table:windows"
|
|
|
|
|
"windows/drivers.table:windows"
|
|
|
|
|
"windows/disk_info.table:windows"
|
|
|
|
|
"windows/chocolatey_packages.table:windows"
|
|
|
|
|
"windows/logical_drives.table:windows"
|
|
|
|
|
"windows/ntdomains.table:windows"
|
|
|
|
|
"windows/authenticode.table:windows"
|
|
|
|
|
"windows/pipes.table:windows"
|
|
|
|
|
"windows/wmi_filter_consumer_binding.table:windows"
|
|
|
|
|
"windows/wmi_event_filters.table:windows"
|
|
|
|
|
"windows/windows_events.table:windows"
|
2020-08-26 21:17:29 +00:00
|
|
|
"windows/windows_eventlog.table:windows"
|
2018-11-30 01:27:21 +00:00
|
|
|
"windows/appcompat_shims.table:windows"
|
2020-01-01 00:22:44 +00:00
|
|
|
"windows/ntfs_journal_events.table:windows"
|
2018-11-30 01:27:21 +00:00
|
|
|
"windows/powershell_events.table:windows"
|
|
|
|
|
"windows/winbaseobj.table:windows"
|
|
|
|
|
"windows/cpu_info.table:windows"
|
|
|
|
|
"windows/wmi_bios_info.table:windows"
|
|
|
|
|
"windows/programs.table:windows"
|
|
|
|
|
"windows/wmi_script_event_consumers.table:windows"
|
|
|
|
|
"windows/physical_disk_performance.table:windows"
|
|
|
|
|
"windows/autoexec.table:windows"
|
2019-10-16 18:20:53 +00:00
|
|
|
"windows/default_environment.table:windows"
|
2019-09-23 21:44:31 +00:00
|
|
|
"windows/windows_security_products.table:windows"
|
2020-02-28 15:51:55 +00:00
|
|
|
"windows/windows_security_center.table:windows"
|
2020-01-31 14:36:39 +00:00
|
|
|
"windows/windows_optional_features.table:windows"
|
2019-10-04 19:18:15 +00:00
|
|
|
"windows/connectivity.table:windows"
|
2020-03-29 17:25:26 +00:00
|
|
|
"windows/userassist.table:windows"
|
2020-07-22 14:51:12 +00:00
|
|
|
"windows/dns_cache.table:windows"
|
2020-04-09 17:03:41 +00:00
|
|
|
"windows/hvci_status.table:windows"
|
2020-07-13 01:54:37 +00:00
|
|
|
"windows/shimcache.table:windows"
|
Add Shellbags table (#6949)
Hello, this largish PR adds shellbags support to osquery.
Shellbags is a complex (imo) windows Registry artifact that primarily keeps track of directories a user has browsed to (specifically directories accessed using Windows Explorer). By parsing shellbags its possible to recreate what directories a user accessed
Shellbags are composed of shellitems, this PR also adds support to parsing several shellitems, finally shellbags also contain FAT timestamps that show when a directory was created, modified, accessed, FAT timestamp parsing is also included in this PR
Example query of what shellbags looks like
```
osquery> select * from shellbags;
+-----------------------------------------------+--------------+-------------------------------------------------------------------------------------+---------------+--------------+---------------+-----------+--------------+
| sid | source | path | modified_time | created_time | accessed_time | mft_entry | mft_sequence |
+-----------------------------------------------+--------------+-------------------------------------------------------------------------------------+---------------+--------------+---------------+-----------+--------------+
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob | 0 | 0 | 0 | 0 | 0 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Downloads | 1571635108 | 1571620406 | 1571635108 | 3074 | 5 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects | 0 | 0 | 0 | 0 | 0 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\osquery | 0 | 0 | 0 | 0 | 0 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\osquery\build | 0 | 0 | 0 | 0 | 0 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\osquery\build\osquery | 0 | 0 | 0 | 0 | 0 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\osquery\build\osquery\RelWithDebInfo | 0 | 0 | 0 | 0 | 0 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\osquery\osquery | 1578192498 | 1571701478 | 1578192498 | 495902 | 4 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\osquery\osquery\killswitch | 1578192406 | 1575859554 | 1578192406 | 707032 | 2 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\clamav-osquery | 1572045050 | 1572045050 | 1572045050 | 221518 | 14 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\clamav-osquery\extension_clamav | 1572045050 | 1572045050 | 1572045050 | 432733 | 8 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\Projects\clamav-osquery\extension_clamav\src | 1572045050 | 1572045050 | 1572045050 | 432736 | 11 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\.osquery | 1571706262 | 1571706212 | 1571706262 | 575462 | 4 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\AppData | 1571623328 | 1571623318 | 1571623328 | 206482 | 7 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\AppData\Local | 1571701908 | 1571623318 | 1571701908 | 206502 | 8 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\AppData\Local\Microsoft | 1593297370 | 1571623318 | 1593297370 | 206504 | 8 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\AppData\Local\Microsoft\Office | 1593297370 | 1593295160 | 1593297370 | 52684 | 60 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\AppData\Local\Microsoft\Office\16.0 | 1593297388 | 1593295160 | 1593297388 | 81742 | 11 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\AppData\Local\autopsy | 1612935328 | 1612935328 | 1612935328 | 37041 | 7 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\AppData\Local\autopsy\Cache | 1612935328 | 1612935328 | 1612935328 | 37104 | 8 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\super secret sensitive stuff | 1613198066 | 1613198066 | 1613198066 | 101729 | 123 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\super secret sensitive stuff\secret data | 1613198092 | 1613198092 | 1613198092 | 383733 | 38 |
| S-1-5-21-1079689790-2336414676-942872339-1001 | usrclass.dat | This PC\C:\Users\bob\super secret sensitive stuff\secret data\dont look secret data | 1613198108 | 1613198108 | 1613198108 | 383736 | 15 |
+-----------------------------------------------+--------------+-------------------------------------------------------------------------------------+---------------+--------------+---------------+-----------+--------------+
```
Due to the complexity of shellbags currently this PR does not support (or only has partial support) for the following shellitems:
* optical disc
* variable (partial support)
* mtp (partial support)
* user property view data (partial support)
I was not able to generate shellbag data (or only some data) for the above shellitems in my windows vms (tested on two different Windows 10 systems, Windows 8.1, and Windows Server 2019), if osquery encounters any unknown shellbag data it will log a warning and mark the shellitem as "[UNKNOWN SHELL FORMAT]" when building directory paths.
The main value of shellbags is reconstructing directories accessed as shown above, but this PR does include additional shellbag support such as FTP servers connected to via Windows Explorer, ZIP files opened, MTP devices (partial), and network shares browsed to via Windows Explorer
This PR is kind of large, let me know if there are any questions, suggestions for improvements, or issues, thanks!
Shellbags references:
[Shellitems](https://github.com/libyal/libfwsi/blob/main/documentation/Windows%20Shell%20Item%20format.asciidoc)
[Shellbags](https://www.magnetforensics.com/blog/forensic-analysis-of-windows-shellbags/)
[Property Stores](https://github.com/libyal/libfwps/blob/main/documentation/Windows%20Property%20Store%20format.asciidoc)
2021-02-26 23:47:37 +00:00
|
|
|
"windows/shellbags.table:windows"
|
2018-11-30 01:27:21 +00:00
|
|
|
"yara/yara_events.table:linux,macos"
|
2020-07-24 01:16:10 +00:00
|
|
|
"yara/yara.table:linux,macos,freebsd,windows"
|
2018-11-30 01:27:21 +00:00
|
|
|
)
|
|
|
|
|
|
2020-11-24 18:50:18 +00:00
|
|
|
if(OSQUERY_BUILD_BPF)
|
|
|
|
|
list(APPEND platform_dependent_spec_files
|
|
|
|
|
"linux/bpf_process_events.table:linux"
|
|
|
|
|
"linux/bpf_socket_events.table:linux"
|
|
|
|
|
)
|
|
|
|
|
endif()
|
|
|
|
|
|
2020-12-22 14:10:32 +00:00
|
|
|
if(OSQUERY_BUILD_AWS)
|
2020-12-31 02:11:51 +00:00
|
|
|
list(APPEND platform_independent_spec_files
|
|
|
|
|
"ec2_instance_metadata.table"
|
|
|
|
|
"ec2_instance_tags.table"
|
2020-12-22 14:10:32 +00:00
|
|
|
)
|
|
|
|
|
endif()
|
|
|
|
|
|
2020-12-26 21:09:16 +00:00
|
|
|
if(OSQUERY_BUILD_DPKG)
|
|
|
|
|
list(APPEND platform_dependent_spec_files
|
|
|
|
|
"linux/deb_packages.table:linux"
|
|
|
|
|
)
|
|
|
|
|
endif()
|
|
|
|
|
|
2019-06-25 08:50:43 +00:00
|
|
|
foreach(spec_descriptor ${platform_dependent_spec_files})
|
2018-11-30 01:27:21 +00:00
|
|
|
string(REPLACE ":" ";" spec_descriptor "${spec_descriptor}")
|
|
|
|
|
list(GET spec_descriptor 0 spec_file)
|
|
|
|
|
|
|
|
|
|
list(GET spec_descriptor 1 spec_descriptor)
|
|
|
|
|
string(REPLACE "," ";" spec_file_platforms "${spec_descriptor}")
|
|
|
|
|
|
|
|
|
|
list(FIND spec_file_platforms "linux" is_linux_compatible)
|
|
|
|
|
list(FIND spec_file_platforms "macos" is_macos_compatible)
|
|
|
|
|
list(FIND spec_file_platforms "freebsd" is_freebsd_compatible)
|
|
|
|
|
list(FIND spec_file_platforms "windows" is_windows_compatible)
|
|
|
|
|
|
|
|
|
|
if(DEFINED PLATFORM_LINUX AND NOT ${is_linux_compatible} EQUAL -1)
|
|
|
|
|
set(enable_spec_file true)
|
|
|
|
|
elseif(DEFINED PLATFORM_MACOS AND NOT ${is_macos_compatible} EQUAL -1)
|
|
|
|
|
set(enable_spec_file true)
|
|
|
|
|
elseif(DEFINED PLATFORM_FREEBSD AND NOT ${is_freebsd_compatible} EQUAL -1)
|
|
|
|
|
set(enable_spec_file true)
|
|
|
|
|
elseif(DEFINED PLATFORM_WINDOWS AND NOT ${is_windows_compatible} EQUAL -1)
|
|
|
|
|
set(enable_spec_file true)
|
|
|
|
|
else()
|
|
|
|
|
set(enable_spec_file false)
|
|
|
|
|
endif()
|
|
|
|
|
|
|
|
|
|
if(${enable_spec_file})
|
|
|
|
|
list(APPEND spec_file_list
|
|
|
|
|
"${spec_file}"
|
|
|
|
|
)
|
2019-06-25 08:50:43 +00:00
|
|
|
else()
|
|
|
|
|
list(APPEND foreign_spec_file_list
|
|
|
|
|
"${spec_file}"
|
|
|
|
|
)
|
2018-11-30 01:27:21 +00:00
|
|
|
endif()
|
|
|
|
|
endforeach()
|
|
|
|
|
|
2019-06-25 08:50:43 +00:00
|
|
|
list(APPEND spec_file_list ${platform_independent_spec_files})
|
|
|
|
|
|
|
|
|
|
generateTableCategoryAmalgamation("native" ${spec_file_list})
|
|
|
|
|
set(generateNativeTables_output "${generateTableCategoryAmalgamation_output}" PARENT_SCOPE)
|
|
|
|
|
set(foreign_spec_file_list_output "${foreign_spec_file_list}" PARENT_SCOPE)
|
2018-11-30 01:27:21 +00:00
|
|
|
endfunction()
|
|
|
|
|
|
|
|
|
|
specsMain()
|
