技能 forensics-osquery
📦
forensics-osquery
v0.1.0 内容修订 r2 高风险 ⚙️ 外部命令📁 文件系统访问🔑 环境变量🌐 网络访问⚡ 包含脚本
使用 osquery 调查端点
事件响应人员需要在不切换工具的情况下快速获取端点证据。此技能指导 Claude、Codex 和 Claude Code 使用 osquery 进行分诊、威胁狩猎和监控。
支持: Claude Codex Code(CC)
安装前请停下并请求确认。
请审查安装计划，并在更改文件前获得用户明确同意。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "forensics-osquery" from https://skillstore.io/skills/agentsecops-forensics-osquery.md and its manifest at https://skillstore.io/api/skills/agentsecops-forensics-osquery/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“forensics-osquery”。 调查一台疑似被攻陷的工作站。
预期结果:
- 一份涵盖进程、用户、网络连接、持久化和近期文件活动的分诊清单。
- 建议检查的 osquery 区域以及解读异常结果的方法。
- 关于时间戳、导出和分析师操作的证据处理说明。
正在使用“forensics-osquery”。 创建一个针对可疑 PowerShell 活动的狩猎任务。
预期结果:
- 一份关联 Windows 进程遥测和可疑命令行指标的狩猎计划。
- 审查期间应排除的预期良性来源。
- 针对父进程、网络连接和持久化痕迹的后续枢轴分析。
正在使用“forensics-osquery”。 为端点队列覆盖范围准备 osqueryd 监控。
预期结果:
- 一份涵盖配置、包、日志记录和服务管理的部署清单。
- 关于查询成本、数据敏感性和基于角色访问的审查要点。
- 从实验室测试到有限生产部署的推出顺序。
安全审计
高风险v10 • 2026/7/23 打开版本化报告
The skill is a legitimate defensive osquery guide, and most static hits are false positives from detection SQL, Markdown, loopback addresses, and sensitive-path indicators. Confirmed risks are endpoint telemetry collection, privileged install or service commands, and an unbundled relative script instruction. Additional concerns include ineffective credential-file detection, potential registry secret logging, and unverified privileged package bootstrapping.
11
已扫描文件
2,880
分析行数
15
复核项
0
已忽略误报
已确认安全问题 (27)
高
Systemd service enablement
sudo systemctl enable osqueryd
The documented command enables osqueryd at boot with root privileges, creating a persistent system service that requires explicit approval.
高
macOS launch agent/daemon
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
The documented sudo launchctl command loads a privileged daemon, creating persistent monitoring behavior that requires explicit approval.
高
macOS launch agent/daemon
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
The documented sudo launchctl command unloads a privileged daemon and changes endpoint monitoring state, which requires explicit approval.
高
assets/forensic-packs/credential-access.conf:18-21references/mitre-attack-queries.md:317-328SKILL.md:112-120
Ineffective Credential-File Access Detection
The credential-file detector joins process_memory_map and treats mapped paths as file-access evidence. Password files are normally read, not memory-mapped, so the query can miss real access.
All three examples use process_memory_map as a proxy for file reads, which does not generally record ordinary reads of password files.
高
Potential Registry Secret Logging
A scheduled query selects registry data from keys containing Credentials or Password. With result logging enabled, plaintext credential-like values could enter osquery logs.
The query explicitly selects the data column every hour, and the bundled configuration enables filesystem result logging.
高
Unverified Privileged Package Bootstrap
The deployment guide imports repository trust material and installs packages as root without a documented fingerprint, checksum, or pinned-version verification step.
The commands fetch trust material over the network and immediately use privileged package tooling without an independent integrity check.
中
Unbundled Relative Script Execution
The workflow instructs users to execute ./scripts/osquery_triage.sh, but the reported package contains no scripts directory. A same-named local file could be executed unintentionally.
The command and script claims are explicit, while the code-filled file structure lists no scripts directory or script files.
中
Copyable Placeholder Database Password
The FleetDM example includes a fixed fleet_password value without an adjacent instruction to replace it, increasing the chance of an insecure copied configuration.
The password is visibly a placeholder, but the example gives no local replacement or secret-management requirement.
显示全部 27 条已确认问题
低
System reconnaissance
"query": "SELECT p.name, p.cmdline, pm.path FROM processes p JOIN process_memory_map pm ON p.pid = p
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT pid, name, cmdline, uid FROM processes WHERE name = 'sudo' AND cmdline NOT LIKE '%-
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT path, filename, mode, uid, gid FROM file WHERE filename LIKE 'id_%' AND path LIKE '
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT user, tty, host, time, pid FROM logged_in_users;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.local_address, ps.local_port, ps.remote_addres
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT lp.pid, lp.port, lp.protocol, lp.address, p.name, p.path, p.cmdline FROM listening_
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT path, filename, size, mtime, uid, gid FROM file WHERE (path LIKE '/etc/%' OR path L
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT u.username, g.groupname FROM users u JOIN user_groups ug ON u.uid = ug.uid JOIN gro
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT p.pid, p.name, p.cmdline, ps.remote_address, ps.remote_port, ps.state FROM processe
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.remote_address, ps.remote_port, ps.state FROM
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT p.pid, p.name, ps.remote_address, ps.remote_port FROM processes p JOIN process_open
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT pid, name, cmdline, remote_address FROM process_open_sockets ps JOIN processes p ON
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT p.pid, p.name, ps.remote_address, ps.remote_port FROM processes p JOIN process_open
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"host_identifier": "hostname",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT hostname, cpu_brand, physical_memory, hardware_model FROM system_info;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT user, tty, host, time, pid FROM logged_in_users;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT p.pid, p.name, p.path, p.cmdline, ps.remote_address, ps.remote_port, ps.protocol, p
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"query": "SELECT lp.pid, lp.port, lp.protocol, lp.address, p.name, p.path FROM listening_ports lp LE
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
低
System reconnaissance
"SELECT uuid AS host_uuid FROM system_info;",
This bundled configuration or scheduled query collects endpoint identity, user, process, file, or network metadata; authorized use is legitimate, but the telemetry requires protection.
能力复核项 (15)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
高
sudo privilege escalation
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $OSQUERY_KEY
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo apt update
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo apt install osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
curl -L https://pkg.osquery.io/rpm/GPG | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo yum-config-manager --add-repo https://pkg.osquery.io/rpm/osquery-s3-rpm.repo
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo yum install osquery
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo systemctl start osqueryd
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo systemctl enable osqueryd
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo launchctl load /Library/LaunchDaemons/com.facebook.osqueryd.plist
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo launchctl unload /Library/LaunchDaemons/com.facebook.osqueryd.plist
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
sudo osqueryd --verbose --config_path=/etc/osquery/osquery.conf
This is an executable sudo command that changes package trust, software, or service state as root; its legitimate purpose still requires explicit authorization.
高
sudo privilege escalation
- Run osqueryi with sudo/admin privileges: `sudo osqueryi`
The instruction launches an interactive osquery shell with root privileges, exposing sensitive tables and requiring explicit authorization.
中
Hardcoded IP address
address: 0.0.0.0:8080
The Fleet example binds the server to 0.0.0.0:8080, exposing it on every network interface unless firewall and access controls restrict it.
中
Shell command substitution
**Execute triage**: `./scripts/osquery_triage.sh > incident_triage_$(date +%Y%m%d_%H%M%S).json`
The command executes a relative triage script with shell substitution, but the referenced scripts directory is not bundled and could resolve to an unintended local file.
风险因素
⚙️ 外部命令 (50)
assets/forensic-packs/credential-access.conf:91 assets/forensic-packs/credential-access.conf:94 assets/forensic-packs/persistence-hunt.conf:67 references/mitre-attack-queries.md:42 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:51 references/mitre-attack-queries.md:53 references/mitre-attack-queries.md:58 references/mitre-attack-queries.md:118 references/mitre-attack-queries.md:46 references/mitre-attack-queries.md:71 references/mitre-attack-queries.md:76 references/mitre-attack-queries.md:195 references/osqueryd-deployment.md:65 references/osqueryd-deployment.md:69 references/osqueryd-deployment.md:453 references/osqueryd-deployment.md:30 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:36 references/osqueryd-deployment.md:37 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:50 references/osqueryd-deployment.md:426 references/osqueryd-deployment.md:429 references/osqueryd-deployment.md:432 references/osqueryd-deployment.md:435 references/osqueryd-deployment.md:442 references/osqueryd-deployment.md:445 references/osqueryd-deployment.md:448 references/osqueryd-deployment.md:485 SKILL.md:45-63 SKILL.md:63-67 SKILL.md:67-76 SKILL.md:76-95 SKILL.md:95-112 SKILL.md:112-120 SKILL.md:120-137 SKILL.md:137-149 SKILL.md:149-152 SKILL.md:152-164 SKILL.md:164-176 SKILL.md:176-193 SKILL.md:193-206 SKILL.md:206-224 SKILL.md:224-239 SKILL.md:239-253 SKILL.md:253-259 SKILL.md:259-271 SKILL.md:271-277
📁 文件系统访问 (29)
assets/forensic-packs/credential-access.conf:86 assets/forensic-packs/ir-triage.conf:64 assets/forensic-packs/lateral-movement.conf:54 assets/forensic-packs/lateral-movement.conf:60 assets/forensic-packs/persistence-hunt.conf:97 assets/forensic-packs/persistence-hunt.conf:13 assets/forensic-packs/persistence-hunt.conf:37 assets/forensic-packs/persistence-hunt.conf:55 assets/forensic-packs/persistence-hunt.conf:67 assets/osquery.conf:48 references/mitre-attack-queries.md:217 references/mitre-attack-queries.md:297 references/mitre-attack-queries.md:110 references/mitre-attack-queries.md:135 references/mitre-attack-queries.md:175 references/mitre-attack-queries.md:176 references/mitre-attack-queries.md:214 references/mitre-attack-queries.md:215 references/mitre-attack-queries.md:228 references/mitre-attack-queries.md:295 references/mitre-attack-queries.md:296 references/osqueryd-deployment.md:152 references/osqueryd-deployment.md:250 references/table-guide.md:162 references/table-guide.md:163 references/table-guide.md:310 SKILL.md:148 SKILL.md:210 SKILL.md:216
🌐 网络访问 (29)
assets/forensic-packs/ir-triage.conf:39 assets/forensic-packs/ir-triage.conf:44 assets/forensic-packs/lateral-movement.conf:43 assets/osquery.conf:53 assets/osquery.conf:58 references/mitre-attack-queries.md:509 references/osqueryd-deployment.md:33 references/osqueryd-deployment.md:44 references/osqueryd-deployment.md:47 references/osqueryd-deployment.md:60 references/osqueryd-deployment.md:67 references/osqueryd-deployment.md:119 references/osqueryd-deployment.md:191 references/osqueryd-deployment.md:319 references/osqueryd-deployment.md:325 references/osqueryd-deployment.md:328 references/table-guide.md:47 references/table-guide.md:91 SKILL.md:22 SKILL.md:23 SKILL.md:24 SKILL.md:488 SKILL.md:489 SKILL.md:490 SKILL.md:491 SKILL.md:492 SKILL.md:56 SKILL.md:181 SKILL.md:188
检测到的模式
System reconnaissance×19Systemd service enablementmacOS launch agent/daemon×2
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/agentsecops-forensics-osquery/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/agentsecops-forensics-osquery?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/agentsecops-forensics-osquery?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/agentsecops-forensics-osquery/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/agentsecops-forensics-osquery.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
AgentSecOps. (2026). forensics-osquery security audit report (audit version 10) [Author version 0.1.0]. Skillstore. https://skillstore.io/skills/agentsecops-forensics-osquery/audits/10BibTeX 引用
@techreport{agentsecops-agentsecops-forensics-osquery-2026,
author = {AgentSecOps},
title = {forensics-osquery security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/agentsecops-forensics-osquery/audits/10},
note = {Author version 0.1.0}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "forensics-osquery security audit report (audit version 10)"
version: "0.1.0"
type: report
authors:
- name: "AgentSecOps"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/agentsecops-forensics-osquery/audits/10"
identifiers:
- type: other
value: "skillstore:agentsecops-forensics-osquery:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 59
架构
100
可维护性
87
内容
70
社区
100
规范符合性
你能构建什么
快速端点分诊
在告警后收集进程、登录、网络和文件元数据。
基于 MITRE 的威胁狩猎
将可疑的 ATT&CK 技术转换为用于端点痕迹的 osquery 检查。
队列监控设计
为持久化、凭据访问和横向移动指标构建计划执行的 osqueryd 包。
试试这些提示
开始端点分诊
使用 forensics-osquery 技能规划初始端点分诊。重点关注进程、用户、网络连接和近期文件。
狩猎持久化
使用 forensics-osquery 技能为 Linux、macOS 和 Windows 创建持久化狩猎工作流。解释每个结果。
映射一项技术
使用 forensics-osquery 技能将 MITRE ATT&CK T1003 映射到痕迹、osquery 检查和证据处理步骤。
设计监控包
使用 forensics-osquery 技能设计一个用于横向移动和凭据访问的 osqueryd 包。包括调优和审查步骤。
最佳实践
- 仅在你拥有明确授权的系统上运行特权查询。
- 将导出的结果存储在具有访问日志记录和保留期限限制的加密位置。
- 在生产端点上启用计划查询之前，先在实验室中测试。
避免
- 不要在没有范围限制的情况下，对生产队列运行广泛的文件或进程查询。
- 不要在移除密钥和个人数据之前共享原始 osquery 结果。
- 不要在未经分析师验证的情况下，将查询命中视为已确认的攻陷。
常见问题
此技能会自动安装 osquery 吗？
不会。它提供指导和示例。用户必须单独安装和配置 osquery。
它可以与 Claude Code 和 Codex 一起使用吗？
可以。元数据列出了 Claude、Codex 和 Claude Code 作为受支持的工具。
为什么此技能需要谨慎使用？
它可以指导收集敏感端点数据，因此需要授权和数据保护。
它会执行攻击者工具吗？
未发现证据。工具名称作为检测字符串出现在 osquery 搜索中。
涵盖哪些平台？
该指导涵盖 Linux、macOS 和 Windows，具体取决于 osquery 表支持。
需要哪些权限？
许多基础查询可以作为普通用户运行。敏感表通常需要提升权限。
开发者详情
作者
AgentSecOps许可证
MIT
作者版本
v0.1.0
Skillstore 修订
r2
仓库
https://github.com/AgentSecOps/SecOpsAgentKit/tree/main/skills/incident-response/forensics-osquery引用
9e952417e76879bc9d853e1b8b2cd6d6d8d4a1c2
维护新鲜度
2026/7/29
使用量
8 次下载 · 220 次浏览