forensics-osquery
Investigate security incidents with osquery SQL forensics
This skill provides SQL-powered forensic investigation using osquery to query operating systems as databases. Use it to collect forensic evidence, hunt for threats, and respond to incidents across Linux, macOS, and Windows endpoints.
Download the skill ZIP
Upload in Claude
Go to Settings → Capabilities → Skills → Upload skill
Toggle on and start using
Test it
Using "forensics-osquery". Show me processes with external network connections
Expected outcome:
- Process: nginx, PID: 1234, Remote: 203.0.113.50:443
- Process: chrome, PID: 5678, Remote: 198.51.100.20:443
Using "forensics-osquery". Find recent file modifications in system directories
Expected outcome:
- File: /etc/passwd, Modified: 2 hours ago
- File: /usr/bin/suspicious Binary, Modified: 30 minutes ago
Using "forensics-osquery". Check for suspicious scheduled tasks
Expected outcome:
- Task: UpdateService, Action: powershell -enc <obfuscated>
Security Audit
SafeAll 810 static findings are FALSE POSITIVES. This is a legitimate DFIR (Digital Forensics and Incident Response) skill using osquery SQL queries to detect malicious activity. The scanner detected detection queries for credential access, PowerShell commands, and suspicious processes - but these are intentionally designed to identify indicators of compromise, not perform malicious actions. Skill includes MITRE ATT&CK mapping and forensic packs for incident response.
Risk Factors
⚙️ External commands (2)
📁 Filesystem access (2)
🌐 Network access (2)
Quality Score
What You Can Build
Incident Response Triage
Rapidly collect system state during security incidents including processes, connections, and user activity.
Hunt for Attack Techniques
Execute MITRE ATT&CK mapped queries to detect adversary techniques across endpoints.
Endpoint Visibility Queries
Query fleets of systems for Indicators of Compromise (IOCs) using SQL-based osquery.
Try These Prompts
Show me all running processes with deleted executables using osquery
Find processes listening on external network interfaces with their full command lines
Query all persistence mechanisms including cron jobs, systemd services, and registry run keys
Detect processes accessing /etc/shadow, SAM database, or browser credential files
Best Practices
- Test queries in a lab environment before running on production systems
- Use WHERE clauses to limit query scope and reduce performance impact
- Export query results for evidence preservation with JSON or CSV output
Avoid
- Do not run unbounded queries on production systems without filtering
- Do not modify systems during live forensics - use read-only queries
- Do not rely solely on osquery for real-time alerting without osqueryd
Frequently Asked Questions
What is osquery?
Does this skill perform live forensics?
What platforms are supported?
Do I need special permissions?
How is this different from EDR?
What MITRE ATT&CK techniques can be detected?
Developer Details
Author
AgentSecOpsLicense
MIT
Repository
https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/incident-response/forensics-osqueryRef
main