$ osqueryiosquery> SELECT DISTINCT    ...>   process.name,    ...>   listening.port,    ...>   process.pid    ...> FROM processes AS process    ...> JOIN listening_ports AS listening    ...> ON process.pid = listening.pid    ...> WHERE listening.address = '0.0.0.0';
+----------+-------+-------+| name     | port  | pid   |+----------+-------+-------+| Spotify  | 57621 | 18666 || ARDAgent | 3283  | 482   |+----------+-------+-------+osquery>

PS C:>Invoke-Expression(New-Object Net.WebClient).DownloadString("http://[URL]/[URI]/VelociraptorStart.ps1")

C:>Powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass Invoke-Expression(New-Object Net.WebClient).DownloadString("http://[URL]/[URI]/VelociraptorStart.ps1")

[root@localhost ~]# curl -s -L 'http://[URL]/[URI]/VelociraptorStart.sh' | bash

C:>msiexec /i http://[URL]/[URI]/Velociraptor.msi /quiet

[root@localhost ~]# rpm -ivh http://[URL]/[URI]/Velociraptor.rpm

SELECT * from pslist()

SELECT * FROM execve(argv=["/bin/bash", "-c", "ls -al"])

SELECT split(string=Stdout, sep="n") as Result FROM execve(argv=["/bin/bash", "-c", "ls -al"])

SELECT     client_id AS ClientId,    agent_information.version AS AgentVer,     os_info.system AS System,    os_info.hostname AS Hostname,     os_info.release AS Release,    os_info.fqdn AS FQDN,    timestamp(epoch=int(int=first_seen_at)) AS FirstSeen,     timestamp(epoch=int(int=last_seen_at/1000)) AS LastSeen,     last_ip AS LastIP,     join(array=labels, sep=" | ") as Labels  from clients()ORDER BY FirstSeen Desc

LET CLIENTS <= SELECT client_id AS ClientId,      agent_information.version AS AgentVer,      os_info.system AS System,      os_info.hostname AS Hostname,      os_info.release AS Release,      os_info.fqdn AS FQDN,      timestamp(epoch=int(int=first_seen_at)) AS FirstSeen,      timestamp(epoch=int(int=last_seen_at/1000)) AS LastSeen,      last_ip AS LastIP,      join(array=labels, sep=" | ") as Labels  FROM clients()
LET LabelHosts <= SELECT * FROM foreach(  row=TargetHostname,  query={      SELECT ClientId, Hostname, Release, FQDN, FirstSeen, LastSeen, LastIP, Labels from CLIENTS WHERE Hostname = "MyHostname"  })
SELECT ClientId, label(labels="MyLabel", op="set", client_id=ClientId) FROM LabelHosts

name: Windows.EventLogs.Evtxdescription: |  Parses and returns events from Windows evtx logs.  ......  Inspired by others in `Windows.EventLogs.*`, many by Matt Green (@mgreen27).
author: Chris Hendricks ([email protected])precondition: SELECT OS FROM info() WHERE OS = 'windows'parameters:  - name: EvtxGlob    default: '%SystemRoot%System32winevtLogs*.evtx'  - name: SearchVSS    description: "Search VSS for EvtxGlob as well."    type: bool  - name: StartDate    type: timestamp    description: "Parse events on or after this date (YYYY-MM-DDTmm:hh:ssZ)"  - name: EndDate    type: timestamp    description: "Parse events on or before this date (YYYY-MM-DDTmm:hh:ssZ)"  - name: PathRegex    default: "."    type: regex  - name: ChannelRegex    default: "."    type: regex  - name: IDRegex    default: "."    type: regex
sources:  - query: |      // expand provided glob into a list of paths on the file system (fs)      LET fspaths <=          SELECT FullPath FROM glob(globs=expand(path=EvtxGlob))          WHERE FullPath =~ PathRegex
      // function returning list of VSS paths corresponding to path      LET vsspaths(path) =          SELECT FullPath FROM Artifact.Windows.Search.VSS(SearchFilesGlob=path)          WHERE FullPath =~ PathRegex
      // function returning parsed evtx from list of paths      LET evtxsearch(pathList) =          SELECT * FROM foreach(            row=pathList,            query={              SELECT *,                timestamp(epoch=int(int=System.TimeCreated.SystemTime)) AS TimeCreated,                System.Channel as Channel,                System.EventRecordID as EventRecordID,                System.EventID.Value as EventID,                FullPath              FROM parse_evtx(filename=FullPath)              WHERE                if(condition=StartDate,                   then=TimeCreated >= timestamp(string=StartDate),                   else=true)                AND if(condition=EndDate,                       then=TimeCreated <= timestamp(string=EndDate),                       else=true)                AND Channel =~ ChannelRegex                AND str(str=EventID) =~ IDRegex            }          )
      // only de-duplicate using GROUP BY when searching VSS      // de-duplicate file-by-file to reduce memory impact      SELECT * FROM if(condition=SearchVSS, then={          SELECT * FROM foreach(row=fspaths, query={            SELECT * FROM evtxsearch(pathList={                SELECT FullPath FROM vsspaths(path=FullPath)            })            GROUP BY EventRecordID,Channel          })        }, else={          SELECT * FROM evtxsearch(pathList={SELECT FullPath FROM fspaths})        })

name: Windows.EventLog.Process
description: |  Parses and returns events from Windows evtx logs.    EventID: 4688 
precondition: SELECT OS FROM info() WHERE OS = 'windows'parameters:  - name: StartDate    type: timestamp    description: "Parse events on or after this date (YYYY-MM-DDTmm:hh:ssZ)"
  - name: EndDate    type: timestamp    description: "Parse events on or before this date (YYYY-MM-DDTmm:hh:ssZ)"
sources:  - name: Process History - EventID 4688    query: |      // expand provided glob into a list of paths on the file system (fs)      LET fspaths <=          SELECT FullPath FROM glob(globs=expand(path="%SystemRoot%\System32\winevt\Logs\Security.evtx"))
      // function returning parsed evtx from list of paths      LET evtxsearch(pathList) =          SELECT * FROM foreach(            row=pathList,            query={              SELECT                 // System,                // EventData,                // Message,                timestamp(epoch=int(int=System.TimeCreated.SystemTime)) AS TimeCreated,                // System.Channel as Channel,                // System.EventRecordID as EventRecordID,                System.EventID.Value as EventID,                // FullPath,                System.Computer as Computer,                      // 4688 EventData Detail                EventData.SubjectUserSid as SubjectUserSid,                EventData.SubjectUserName as SubjectUserName,                EventData.SubjectDomainName as SubjectDomainName,                EventData.SubjectLogonId as SubjectLogonId,                EventData.NewProcessId as NewProcessId,                EventData.NewProcessName as NewProcessName,                // EventData.TokenElevationType as TokenElevationType,                EventData.ParentProcessName as ParentProcessName,                EventData.ProcessId as ProcessId,                EventData.CommandLine as CommandLine,                EventData.TargetUserSid as TargetUserSid,                EventData.TargetUserName as TargetUserName,                EventData.TargetDomainName as TargetDomainName,                EventData.TargetLogonId as TargetLogonId,                EventData.MandatoryLabel as MandatoryLabel                    FROM parse_evtx(filename=FullPath)              WHERE                if(condition=StartDate,                   then=TimeCreated >= timestamp(string=StartDate),                   else=true)                AND if(condition=EndDate,                       then=TimeCreated <= timestamp(string=EndDate),                       else=true)                AND EventID = 4688            }          )
      SELECT * FROM evtxsearch(pathList={SELECT FullPath FROM fspaths})    notebook:      - type: VQL        template: |          /*          --------------------------------------------------------------          ## 进程启动历史: EventID:4688           */          SELECT TimeCreated, SubjectUserName, ProcessId, ParentProcessName, CommandLine, NewProcessId, NewProcessName           FROM source()           WHERE NOT SubjectUserName =~ "\$"          ORDER BY TimeCreated Desc          Limit 50

name: Windows.Sysinternals.Autorunsdescription: |  Uses Sysinternals autoruns to scan the host.
  Note this requires syncing the sysinternals binary from the host.
tools:  - name: Autorun_x86    url: https://live.sysinternals.com/tools/autorunsc.exe    serve_locally: true
  - name: Autorun_amd64    url: https://live.sysinternals.com/tools/autorunsc64.exe    serve_locally: true
precondition: SELECT OS From info() where OS = 'windows'
parameters:  - name: All    type: bool    default: Y  - name: Boot execute    type: bool  - name: Codecs    type: bool  - name: Appinit DLLs    type: bool  - name: Explorer addons    type: bool  - name: Sidebar gadgets (Vista and higher)    type: bool  - name: Image hijacks    type: bool  - name: Internet Explorer addons    type: bool  - name: Known DLLs    type: bool  - name: Logon startups (this is the default)    type: bool  - name: WMI entries    type: bool  - name: Winsock protocol and network providers    type: bool  - name: Office addins    type: bool  - name: Printer monitor DLLs    type: bool  - name: LSA security providers    type: bool  - name: Autostart services and non-disabled drivers    type: bool  - name: Scheduled tasks    type: bool  - name: Winlogon entries    type: bool  - name: ToolInfo    type: hidden    description: Override Tool information.
sources:  - query: |      LET Flags = '''Option,Name      *,All      b,Boot execute      c,Codecs      d,Appinit DLLs      e,Explorer addons      g,Sidebar gadgets (Vista and higher)      h,Image hijacks      i,Internet Explorer addons      k,Known DLLs      l,Logon startups (this is the default)      m,WMI entries      n,Winsock protocol and network providers      o,Office addins      p,Printer monitor DLLs      r,LSA security providers      s,Autostart services and non-disabled drivers      t,Scheduled tasks      w,Winlogon entries      '''
      -- The options actually selected      LET options = SELECT Option FROM parse_csv(accessor="data", filename=Flags)        WHERE get(field=Name)
      LET os_info <= SELECT Architecture FROM info()
      // Get the path to the binary.      LET bin <= SELECT * FROM Artifact.Generic.Utils.FetchBinary(              ToolName= "Autorun_" + os_info[0].Architecture,              ToolInfo=ToolInfo)
      // Call the binary and return all its output in a single row.      LET output = SELECT * FROM execve(argv=[bin[0].FullPath,            '-nobanner', '-accepteula', '-t', '-a',            join(array=options.Option, sep=""),            '-c', -- CSV output            '-h', -- Also calculate hashes            '*'   -- All user profiles.      ], length=10000000)
      // Parse the CSV output and return it as rows. We can filter this further.      SELECT * FROM if(condition=bin,      then={        SELECT * FROM foreach(          row=output,          query={             SELECT * FROM parse_csv(filename=utf16(string=Stdout),                                     accessor="data")          })      })