Skills forensics-osquery
📦

forensics-osquery

v0.1.0 Content revision r2 High Risk ⚙️ External commands📁 Filesystem access🔑 Env variables🌐 Network access⚡ Contains scripts

Investigate Endpoints with osquery

Endpoint investigations often require many platform-specific tools and commands. This skill provides osquery workflows, detection queries, and packs for consistent forensic collection across major platforms.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "forensics-osquery" from https://skillstore.io/skills/agentsecops-forensics-osquery.md and its manifest at https://skillstore.io/api/skills/agentsecops-forensics-osquery/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/agentsecops-forensics-osquery.md Signed manifest GET /api/skills/agentsecops-forensics-osquery/manifest Signed lockfile GET /api/skills/agentsecops-forensics-osquery/lockfile

Test it

Using "forensics-osquery". Triage a Linux server with unusual outbound connections.

Expected outcome:

  • Start with process-to-socket correlation and exclude only verified infrastructure addresses.
  • Review process ancestry, executable paths, command lines, users, and start times.
  • Preserve results with timestamps and document every environment-specific exclusion.

Using "forensics-osquery". Investigate possible Windows scheduled-task persistence.

Expected outcome:

Review enabled tasks, actions, paths, owners, and recent execution times. Prioritize user-writable locations and encoded command interpreters for validation.

Using "forensics-osquery". Create a safe credential-access hunt.

Expected outcome:

Collect process and event metadata without secret values. Validate suspicious commands against approved administration activity and protect all exported telemetry.

Security Audit

High Risk
v10 • 7/23/2026 Open versioned report

The skill is a legitimate defensive osquery guide, and most static hits are false positives from detection SQL, Markdown, loopback addresses, and sensitive-path indicators. Confirmed risks are endpoint telemetry collection, privileged install or service commands, and an unbundled relative script instruction. Additional concerns include ineffective credential-file detection, potential registry secret logging, and unverified privileged package bootstrapping.

11
Files scanned
2,880
Lines analyzed
15
Review items
0
False positives ignored

Confirmed security concerns (27)

High
references/osqueryd-deployment.md:429
Systemd service enablement
sudo systemctl enable osqueryd
The documented command enables osqueryd at boot with root privileges, creating a persistent system service that requires explicit approval.
High
references/osqueryd-deployment.md:442
macOS launch agent/daemon
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
The documented sudo launchctl command loads a privileged daemon, creating persistent monitoring behavior that requires explicit approval.
High
references/osqueryd-deployment.md:445
macOS launch agent/daemon
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
The documented sudo launchctl command unloads a privileged daemon and changes endpoint monitoring state, which requires explicit approval.
High
assets/forensic-packs/credential-access.conf:18-21references/mitre-attack-queries.md:317-328SKILL.md:112-120
Ineffective Credential-File Access Detection
The credential-file detector joins process_memory_map and treats mapped paths as file-access evidence. Password files are normally read, not memory-mapped, so the query can miss real access.
All three examples use process_memory_map as a proxy for file reads, which does not generally record ordinary reads of password files.
High
assets/forensic-packs/credential-access.conf:97-101assets/osquery.conf:3-7
Potential Registry Secret Logging
A scheduled query selects registry data from keys containing Credentials or Password. With result logging enabled, plaintext credential-like values could enter osquery logs.
The query explicitly selects the data column every hour, and the bundled configuration enables filesystem result logging.
High
references/osqueryd-deployment.md:27-50
Unverified Privileged Package Bootstrap
The deployment guide imports repository trust material and installs packages as root without a documented fingerprint, checksum, or pinned-version verification step.
The commands fetch trust material over the network and immediately use privileged package tooling without an independent integrity check.
Medium
SKILL.md:93-95SKILL.md:304-309
Unbundled Relative Script Execution
The workflow instructs users to execute ./scripts/osquery_triage.sh, but the reported package contains no scripts directory. A same-named local file could be executed unintentionally.
The command and script claims are explicit, while the code-filled file structure lists no scripts directory or script files.
Medium
references/osqueryd-deployment.md:316-336
Copyable Placeholder Database Password
The FleetDM example includes a fixed fleet_password value without an adjacent instruction to replace it, increasing the chance of an insecure copied configuration.
The password is visibly a placeholder, but the example gives no local replacement or secret-management requirement.
Show all 27 confirmed findings
Low
assets/forensic-packs/credential-access.conf:19
System reconnaissance
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/credential-access.conf:74
System reconnaissance
"query": "SELECT pid, name, cmdline, uid FROM processes WHERE name = 'sudo' AND cmdline NOT LIKE '%-
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/credential-access.conf:86
System reconnaissance
"query": "SELECT path, filename, mode, uid, gid FROM file WHERE filename LIKE 'id_%' AND path LIKE '
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/ir-triage.conf:19
System reconnaissance
"query": "SELECT user, tty, host, time, pid FROM logged_in_users;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/ir-triage.conf:39
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.local_address, ps.local_port, ps.remote_addres
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/ir-triage.conf:44
System reconnaissance
"query": "SELECT lp.pid, lp.port, lp.protocol, lp.address, p.name, p.path, p.cmdline FROM listening_
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/ir-triage.conf:70
System reconnaissance
"query": "SELECT path, filename, size, mtime, uid, gid FROM file WHERE (path LIKE '/etc/%' OR path L
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/ir-triage.conf:75
System reconnaissance
"query": "SELECT u.username, g.groupname FROM users u JOIN user_groups ug ON u.uid = ug.uid JOIN gro
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/lateral-movement.conf:7
System reconnaissance
"query": "SELECT p.pid, p.name, p.cmdline, ps.remote_address, ps.remote_port, ps.state FROM processe
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/lateral-movement.conf:13
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.remote_address, ps.remote_port, ps.state FROM
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/lateral-movement.conf:37
System reconnaissance
"query": "SELECT p.pid, p.name, ps.remote_address, ps.remote_port FROM processes p JOIN process_open
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/lateral-movement.conf:66
System reconnaissance
"query": "SELECT pid, name, cmdline, remote_address FROM process_open_sockets ps JOIN processes p ON
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/forensic-packs/lateral-movement.conf:95
System reconnaissance
"query": "SELECT p.pid, p.name, ps.remote_address, ps.remote_port FROM processes p JOIN process_open
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/osquery.conf:19
System reconnaissance
"host_identifier": "hostname",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/osquery.conf:28
System reconnaissance
"query": "SELECT hostname, cpu_brand, physical_memory, hardware_model FROM system_info;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/osquery.conf:38
System reconnaissance
"query": "SELECT user, tty, host, time, pid FROM logged_in_users;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/osquery.conf:53
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.remote_address, ps.remote_port, ps.protocol, p
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/osquery.conf:58
System reconnaissance
"query": "SELECT lp.pid, lp.port, lp.protocol, lp.address, p.name, p.path FROM listening_ports lp LE
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Low
assets/osquery.conf:73
System reconnaissance
"SELECT uuid AS host_uuid FROM system_info;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
Capability review items (15)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
references/osqueryd-deployment.md:30
sudo privilege escalation
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $OSQUERY_KEY
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:33
sudo privilege escalation
sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:36
sudo privilege escalation
sudo apt update
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:37
sudo privilege escalation
sudo apt install osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:44
sudo privilege escalation
curl -L https://pkg.osquery.io/rpm/GPG | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:47
sudo privilege escalation
sudo yum-config-manager --add-repo https://pkg.osquery.io/rpm/osquery-s3-rpm.repo
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:50
sudo privilege escalation
sudo yum install osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:426
sudo privilege escalation
sudo systemctl start osqueryd
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:429
sudo privilege escalation
sudo systemctl enable osqueryd
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:442
sudo privilege escalation
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:445
sudo privilege escalation
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
references/osqueryd-deployment.md:485
sudo privilege escalation
sudo osqueryd --verbose --config_path=/etc/osquery/osquery.conf
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
High
SKILL.md:453
sudo privilege escalation
- Run osqueryi with sudo/admin privileges: `sudo osqueryi`
The instruction launches an interactive osquery shell with root privileges, exposing sensitive tables and requiring explicit authorization.
Medium
references/osqueryd-deployment.md:328
Hardcoded IP address
address: 0.0.0.0:8080
The Fleet example binds the server to 0.0.0.0:8080, exposing it on every network interface unless firewall and access controls restrict it.
Medium
SKILL.md:95
Shell command substitution
**Execute triage**: `./scripts/osquery_triage.sh > incident_triage_$(date +%Y%m%d_%H%M%S).json`
The command executes a relative triage script with shell substitution, but the referenced scripts directory is not bundled and could resolve to an unintended local file.

Risk Factors

⚙️ External commands (50)
assets/forensic-packs/credential-access.conf:91 assets/forensic-packs/credential-access.conf:94 assets/forensic-packs/persistence-hunt.conf:67 references/mitre-attack-queries.md:42 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:51 references/mitre-attack-queries.md:53 references/mitre-attack-queries.md:58 references/mitre-attack-queries.md:118 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:71 references/mitre-attack-queries.md:76 references/mitre-attack-queries.md:195 references/osqueryd-deployment.md:65 references/osqueryd-deployment.md:69 references/osqueryd-deployment.md:453 references/osqueryd-deployment.md:30 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:36 references/osqueryd-deployment.md:37 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:50 references/osqueryd-deployment.md:426 references/osqueryd-deployment.md:429 references/osqueryd-deployment.md:432 references/osqueryd-deployment.md:435 references/osqueryd-deployment.md:442 references/osqueryd-deployment.md:445 references/osqueryd-deployment.md:448 references/osqueryd-deployment.md:485 SKILL.md:45-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-95 SKILL.md:95-112 SKILL.md:112-120 SKILL.md:120-137 SKILL.md:137-149 SKILL.md:149-152 SKILL.md:152-164 SKILL.md:164-176 SKILL.md:176-193 SKILL.md:193-206 SKILL.md:206-224 SKILL.md:224-239 SKILL.md:239-253 SKILL.md:253-259 SKILL.md:259-271 SKILL.md:271-277
📁 Filesystem access (29)
assets/forensic-packs/credential-access.conf:86 assets/forensic-packs/ir-triage.conf:64 assets/forensic-packs/lateral-movement.conf:54 assets/forensic-packs/lateral-movement.conf:60 assets/forensic-packs/persistence-hunt.conf:97 assets/forensic-packs/persistence-hunt.conf:13 assets/forensic-packs/persistence-hunt.conf:37 assets/forensic-packs/persistence-hunt.conf:55 assets/forensic-packs/persistence-hunt.conf:67 assets/osquery.conf:48 references/mitre-attack-queries.md:217 references/mitre-attack-queries.md:297 references/mitre-attack-queries.md:110 references/mitre-attack-queries.md:135 references/mitre-attack-queries.md:175 references/mitre-attack-queries.md:176 references/mitre-attack-queries.md:214 references/mitre-attack-queries.md:215 references/mitre-attack-queries.md:228 references/mitre-attack-queries.md:295 references/mitre-attack-queries.md:296 references/osqueryd-deployment.md:152 references/osqueryd-deployment.md:250 references/table-guide.md:162 references/table-guide.md:163 references/table-guide.md:310 SKILL.md:148 SKILL.md:210 SKILL.md:216
🔑 Env variables (1)
assets/forensic-packs/credential-access.conf:85
🌐 Network access (29)
assets/forensic-packs/ir-triage.conf:39 assets/forensic-packs/ir-triage.conf:44 assets/forensic-packs/lateral-movement.conf:43 assets/osquery.conf:53 assets/osquery.conf:58 references/mitre-attack-queries.md:509 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:60 references/osqueryd-deployment.md:67 references/osqueryd-deployment.md:119 references/osqueryd-deployment.md:191 references/osqueryd-deployment.md:319 references/osqueryd-deployment.md:325 references/osqueryd-deployment.md:328 references/table-guide.md:47 references/table-guide.md:91 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:488 SKILL.md:489 SKILL.md:490 SKILL.md:491 SKILL.md:492 SKILL.md:56 SKILL.md:181 SKILL.md:188
⚡ Contains scripts (4)
assets/osquery.conf:13 references/osqueryd-deployment.md:96 references/osqueryd-deployment.md:143 references/osqueryd-deployment.md:374

Detected Patterns

System reconnaissance×19Systemd service enablementmacOS launch agent/daemon×2
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/agentsecops-forensics-osquery/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/agentsecops-forensics-osquery/security.svg)](https://skillstore.io/skills/agentsecops-forensics-osquery?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/agentsecops-forensics-osquery?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-forensics-osquery/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/agentsecops-forensics-osquery.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

AgentSecOps. (2026). forensics-osquery security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-forensics-osquery/audits/10

BibTeX citation

@techreport{agentsecops-agentsecops-forensics-osquery-2026, author = {AgentSecOps}, title = {forensics-osquery security audit report (audit version 10)}, institution = {Skillstore}, year = {2026}, number = {10}, url = {https://skillstore.io/skills/agentsecops-forensics-osquery/audits/10}, note = {Author version 0.1.0} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "forensics-osquery security audit report (audit version 10)" version: "0.1.0" type: report authors: - name: "AgentSecOps" date-released: "2026-07-23" url: "https://skillstore.io/skills/agentsecops-forensics-osquery/audits/10" identifiers: - type: other value: "skillstore:agentsecops-forensics-osquery:audit:10" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
59
Architecture
100
Maintainability
87
Content
70
Community
100
Spec Compliance

What You Can Build

Triage a suspected endpoint

Collect process, login, network, persistence, and recent file metadata using authorized read-only queries.

Hunt a MITRE ATT&CK technique

Select relevant endpoint artifacts, tailor detection queries, and document evidence for a defined hunting hypothesis.

Build continuous osquery monitoring

Design scheduled query packs with suitable intervals, logging controls, platform filters, and resource limits.

Try These Prompts

Prepare basic endpoint triage 
Create an authorized, read-only osquery triage plan for [platform]. Cover processes, users, network connections, persistence, and evidence handling.
Investigate persistence 
Design read-only osquery checks for suspected persistence on [platform]. Explain each artifact, expected benign results, suspicious indicators, and required privileges.
Hunt credential access 
Build an authorized osquery hunt for credential-access technique [MITRE ID]. Avoid collecting secret contents and include validation steps for every detection assumption.
Design a production monitoring pack 
Propose an osqueryd monitoring pack for [environment]. Include platform constraints, intervals, expected volume, privacy controls, false-positive tuning, and staged validation.

Best Practices

  • Run only on systems where investigation and telemetry collection are authorized.
  • Test queries in a representative lab and verify table schemas before production deployment.
  • Encrypt results, restrict access, define retention, and preserve timestamps for chain of custody.

Avoid

  • Do not collect password, token, private-key, or registry secret contents when metadata is sufficient.
  • Do not deploy broad scheduled queries without platform filters, baselines, and resource measurements.
  • Do not execute privileged installation or service commands without explicit approval and package integrity verification.

Frequently Asked Questions

Does this skill install osquery automatically?
No. It includes deployment guidance, but installation and service changes require explicit authorization and elevated access.
Which operating systems are covered?
The material covers Linux, macOS, and Windows, although table availability varies by osquery version and platform.
Are the bundled queries read-only?
The osquery examples are read-only, but their results can contain sensitive system, user, process, network, and file metadata.
Can it replace a full forensic suite?
No. It supports live endpoint interrogation but does not provide disk imaging, memory acquisition, deleted-file recovery, or independent evidence validation.
Can the query packs run without testing?
No. Validate schemas, performance, event-table prerequisites, expected volume, and false positives in a representative lab first.
How should investigation results be protected?
Use encrypted storage, strict access controls, limited retention, audit logging, and documented handling procedures appropriate for forensic evidence.

Developer Details

License

MIT

Author version

v0.1.0

Skillstore revision

r2

Repository

https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/incident-response/forensics-osquery

Ref

9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2

Maintenance freshness

7/24/2026

Usage

8 downloads · 220 views

File structure

📁 assets/

📄 .gitkeep

📁 forensic-packs/

📄 credential-access.conf

📄 ir-triage.conf

📄 lateral-movement.conf

📄 persistence-hunt.conf

📄 osquery.conf

📁 references/

📄 mitre-attack-queries.md

📄 osqueryd-deployment.md

📄 platform-differences.md

📄 table-guide.md

📄 SKILL.md

More from AgentSecOps

View all

Related Skills

View all