start	end	text
15280	18940	Hello, everyone. Welcome back to DEF CON 28, Blue Team Village.
18940	21100	We're going to start our next talk.
21100	26080	This is a recorded video from the Recall EMPASEC team
26820	29220	discussing OS Query,
29220	30700	continuing on the theme of the introduction
30700	33260	of the OpenSoC CTF tools.
33480	36700	In this case, Eric is going to be doing the narration,
37040	40900	and I'm going to post in the Text Workshops Track 1
41480	43160	the link to the YouTube page
43160	45040	where they actually have a lot of these recordings
45660	48880	already stored up if you want to go watch them and take a look.
49020	51840	On that note, we're going to get this recorded started,
51840	55020	and everybody have a good view.
59900	62600	All right, this is Eric with Recall EMPASEC
62600	67860	giving a high-level overview of our new OS Query interface tool.
68280	70740	So as you may have known from previous iterations
70740	72280	of our network defense range,
72280	74380	we relied on a tool called Collide
74380	76260	for interacting with OS Query.
76260	79040	And while Collide is a fantastic interface,
79040	82220	the one issue that we had was it doesn't scale well
82220	84700	under heavy load when we have a lot of participants
84700	85880	in the environment.
85880	88740	And also, it doesn't give much to folks
88740	92000	that are new to writing queries in OS Query.
92020	94840	It sort of expects that you're already pretty familiar
94840	96280	with SQL syntax.
96560	98740	And so what we wanted to do was build an interface
99400	102080	that would guide you through building your query
102540	106480	without having to know the actual syntax behind the scenes.
106720	109240	So I'm going to walk you through crafting a query,
109520	111320	a really simple one, to kind of give you an idea
111320	112960	of how to use this tool.
113040	115520	So you'll notice the very first option we have here
115520	117860	on the Query Builder is,
117860	120760	which operating system am I wanting to interrogate?
120940	122200	And the reason we select this is
122200	126000	because it will then populate the appropriate systems
126000	129040	in the environment that fall into that operating system.
129040	130360	So I've selected Windows,
130360	131840	and what it's done is it's returned
131840	133340	all the systems in the environment
133340	135800	that are running the Windows operating system,
135800	137000	which is quite a few.
137440	140000	Now I can choose to query any one
140000	143160	or multiple systems in this list,
143160	145400	you know, by simply selecting one
145400	149300	or holding Control and maybe selecting,
149300	150560	I'm sorry, I'm on a Mac,
150560	152600	so my Control doesn't work the way it should,
152600	155740	but holding Control on a Windows system
155740	160020	or just holding Shift and selecting multiple systems,
160020	166440	I can query, say, ACC01 through 04 just like this here.
166600	171120	Now the next option is which table I want to query.
171140	173480	So tables are another topic.
173480	174960	There's great resources out there
174960	176960	to help understand all these different tables
176960	178680	and what's contained within them.
178680	180820	If you go to osquery.io,
180820	182940	there's a schema that will help you understand
182940	184360	what all these tables are.
184360	187300	But for simplicity, I'll just pick a very simple
187300	190480	and very straightforward table here called File.
190860	193520	So you notice as soon as I selected File here,
193520	196020	over here on the right-hand side, some examples popped up.
196020	198780	These are sample queries that are commonly used
198780	202120	when the File table is being interrogated.
202120	204140	So you can see here where it's showing an example
204140	208020	where I'm selecting all columns from the File table
208020	210920	where the path is Etsy password, right?
210920	212980	Or where the path is simply Etsy
212980	214880	or where it's Etsy wildcard
214880	218020	because a percent sign is a wildcard in SQL.
218320	220240	So anyway, I can use that as inspiration
220240	222620	as I continue to build my query here.
222640	224780	So the next thing that I'm going to have to figure out
224780	227540	is which columns from the File table
227540	230520	do I want returned by my query?
230860	233080	And as you can see here, we're giving you some advice
233080	235240	that a safe bet is usually just to say,
235240	237040	just bring back all columns.
237560	239900	Until I know what's in those columns,
239900	243160	then I can get more specific later on with my query.
243160	245760	So just bringing back all columns is usually a safe bet.
246440	248720	Now, the next part is where I'm going to filter down
248720	250160	the results that are returned to me
250160	251480	because maybe there's a good chance
251480	254320	I don't want all the files on the File system.
254320	258320	Well, I hope not because that's way too large of a query.
258320	260600	So I'm going to have to be more specific than that.
260600	263480	So what I'll say is I only want to see files
264180	274720	where the path is like C user's percent sign,
274720	279460	so I can hit every user in the user's directory, downloads.
280380	284960	So if you notice, I'm simply just taking inspiration from up here, right?
284960	290960	Select star, all columns, from file where path like,
290960	293100	and then you can see a path with a wildcard here.
293100	295340	So I've just basically kind of copied that example
295340	302560	and made it my own, where path like C user's wildcard slash downloads.
302600	305940	So when I click run query, scroll up here,
305940	307860	and you can see this little indicator showing me
307860	311240	that that query has been issued out to ACC 1 through 4.
311260	313560	And you can also see that it's giving me a preview
313560	317880	of the back-end syntax of what that query I just wrote looks like.
318240	321280	All right, so we've got our responses back from ACC 1 through 4.
321280	324360	You notice there are no results, which is just simply telling me
324360	327520	that none of those systems had anything in their downloads directories,
327520	328460	and that's fine.
328560	330480	So maybe what I'll do now is I'll tweak the query
330480	333460	in a way that I know will bring back some results.
333460	337380	I'll just simply say, just show me everything in C users, right?
337380	340180	I've got my wildcard here on the end, run query.
340460	344080	So technically, this is going to enumerate all the users on each of these systems
344080	349420	based on the presence of a user profile directory in that location.
352890	357170	All right, so starting with the first system that returned, ACC 04,
357170	358930	you can kind of scroll through the results here
360630	363850	and see that it's showing me the directory that was returned,
363850	368630	C users, all users, an award, default, public, obviously the root directory,
368630	370650	and then also this help desk user as well.
370690	375610	So that's kind of, you know, a unique approach to maybe identifying
375610	378590	all the users that have interactively logged on to this system.
378590	385010	But really just to show you a very simple query syntax here that you can use.
385190	389930	Now, let me caution you with something that you need to avoid
389930	393110	when writing queries with osquery.
393390	397370	Another popular table is, for instance, the hash table.
397370	399810	Hash is very much like the file table,
399810	403490	except instead of just simply listing the files in a location,
403490	408570	it will provide the SHA-256, SHA-1, MD5 hashes of all those files as well.
408570	414110	Which is a very useful capability, especially when you're performing a DFIR.
414370	419190	But the thing is, is calculating hashes is a very expensive operation.
419230	422070	And so osquery is not going to simply allow,
422070	426250	it's not going to allow you to request hashes of every file in the file system.
426250	429470	So you always need to be as specific as possible.
429470	432270	So especially when using, say, the hash table.
432270	434590	I'll still return all columns, that's fine,
434590	438970	but I'm going to have to be very specific in my query here.
438970	443550	Where path, like, I'm going to want to dive down deeper
443550	450730	and know a little closer to the goods of the files that I actually want to hash.
450810	453110	Now what you do not want to do,
453110	458790	in many of these tables, you do not want to use leading wildcards.
459170	463090	So for instance, if I just wanted to hash any file on the file system
463090	467070	with the word malware in it, that might seem like a clever approach,
467070	470070	but osquery is not going to let me get away with this.
470070	472950	And I'll show you, for example, if I run this query,
472950	477130	what's going to happen is it's likely just simply going to fail to return at all.
477510	481770	And this can often lead you to believe that maybe osquery isn't working properly,
481770	486290	or, you know, and so what I'm trying to show you here is, you know,
486290	488850	if you get zero results, it could mean that
488850	491790	maybe there simply is nothing that matches your query,
491790	495530	or maybe you need to refactor your query to be more specific,
495530	498750	because the osquery agent is not going to allow you to make
498750	502090	really, really greedy queries that would cause a performance issue
502090	504110	on the system down below.
505150	507570	Alright, so that's a brief introduction.