diff --git a/accessors/data/data.go b/accessors/data/data.go index 19728f9c627..0983f9ed876 100644 --- a/accessors/data/data.go +++ b/accessors/data/data.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/file/accessor_darwin.go b/accessors/file/accessor_darwin.go index 947c9948b85..daac835bd67 100644 --- a/accessors/file/accessor_darwin.go +++ b/accessors/file/accessor_darwin.go @@ -2,7 +2,7 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/file/accessor_freebsd.go b/accessors/file/accessor_freebsd.go index ad407444a77..27d800a8c58 100644 --- a/accessors/file/accessor_freebsd.go +++ b/accessors/file/accessor_freebsd.go @@ -2,7 +2,7 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/file/accessor_linux.go b/accessors/file/accessor_linux.go index 7e44bb2fcfd..3fef3fd8fb3 100644 --- a/accessors/file/accessor_linux.go +++ b/accessors/file/accessor_linux.go @@ -2,7 +2,7 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/file/os_windows.go b/accessors/file/os_windows.go index 28563042e35..2a8c202d549 100644 --- a/accessors/file/os_windows.go +++ b/accessors/file/os_windows.go @@ -2,7 +2,7 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/ntfs/mft.go b/accessors/ntfs/mft.go index bf3b296b07f..a979282a2e6 100644 --- a/accessors/ntfs/mft.go +++ b/accessors/ntfs/mft.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/ntfs/ntfs_accessor.go b/accessors/ntfs/ntfs_accessor.go index 3891044ff0b..8bef0544fcb 100644 --- a/accessors/ntfs/ntfs_accessor.go +++ b/accessors/ntfs/ntfs_accessor.go @@ -3,7 +3,7 @@ package ntfs // This is an accessor which represents an NTFS filesystem /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/raw_registry/raw_registry.go b/accessors/raw_registry/raw_registry.go index 3b6408cfd52..2dfa678190e 100644 --- a/accessors/raw_registry/raw_registry.go +++ b/accessors/raw_registry/raw_registry.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/registry/registry_windows.go b/accessors/registry/registry_windows.go index 90233cca7ac..19015d63a28 100644 --- a/accessors/registry/registry_windows.go +++ b/accessors/registry/registry_windows.go @@ -2,7 +2,7 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/zip/gzip.go b/accessors/zip/gzip.go index e0f6446e513..7d53035acc2 100644 --- a/accessors/zip/gzip.go +++ b/accessors/zip/gzip.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/accessors/zip/zip.go b/accessors/zip/zip.go index 2202b57c219..5beb9b4ec64 100644 --- a/accessors/zip/zip.go +++ b/accessors/zip/zip.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/actions/events.go b/actions/events.go index 384ebf37c31..c80805a6c0c 100644 --- a/actions/events.go +++ b/actions/events.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/actions/vql.go b/actions/vql.go index 111cd0e610a..da82b4034a0 100644 --- a/actions/vql.go +++ b/actions/vql.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/api.go b/api/api.go index a8636ea7dc4..90b71d181ff 100644 --- a/api/api.go +++ b/api/api.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/artifacts.go b/api/artifacts.go index 6503c3cac3e..ebdaea718d5 100644 --- a/api/artifacts.go +++ b/api/artifacts.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/assets.go b/api/assets.go index da81a44251f..4e703bbce75 100644 --- a/api/assets.go +++ b/api/assets.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/auth.go b/api/auth.go index 19c43421972..bc2575ea4dd 100644 --- a/api/auth.go +++ b/api/auth.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/authenticators/azure.go b/api/authenticators/azure.go index 0283bc33a0a..10c1f58697c 100644 --- a/api/authenticators/azure.go +++ b/api/authenticators/azure.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/authenticators/github.go b/api/authenticators/github.go index ff3e513b58d..94dfb879ded 100644 --- a/api/authenticators/github.go +++ b/api/authenticators/github.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/authenticators/google.go b/api/authenticators/google.go index dbb6582e772..f7544fae34e 100644 --- a/api/authenticators/google.go +++ b/api/authenticators/google.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/clients.go b/api/clients.go index 941c24ca92c..c1ac4bd1e75 100644 --- a/api/clients.go +++ b/api/clients.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/download.go b/api/download.go index 90c911ba3d5..6bdac2a055c 100644 --- a/api/download.go +++ b/api/download.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/handlers.go b/api/handlers.go index 3fde0f32b86..1c81424c4a1 100644 --- a/api/handlers.go +++ b/api/handlers.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/proxy.go b/api/proxy.go index 85a1fdcddad..e9b0667da43 100644 --- a/api/proxy.go +++ b/api/proxy.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/query.go b/api/query.go index 83b799845ce..0ec432fd845 100644 --- a/api/query.go +++ b/api/query.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/reflect.go b/api/reflect.go index 655394758d7..8a597081e70 100644 --- a/api/reflect.go +++ b/api/reflect.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/tables/table.go b/api/tables/table.go index 5aa44ee6d87..47df84a33d1 100644 --- a/api/tables/table.go +++ b/api/tables/table.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/vfs.go b/api/vfs.go index 15df260649c..07f2417696e 100644 --- a/api/vfs.go +++ b/api/vfs.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/api/vql.go b/api/vql.go index 451b9ccc3cf..9c569089b30 100644 --- a/api/vql.go +++ b/api/vql.go @@ -1,6 +1,6 @@ /* Velociraptor - Dig Deeper - Copyright (C) 2019-2022 Rapid7 Inc. + Copyright (C) 2019-2024 Rapid7 Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published diff --git a/artifacts/definitions/Linux/Detection/Yara/Process.yaml b/artifacts/definitions/Linux/Detection/Yara/Process.yaml index 90c945db848..a1fc6931b17 100644 --- a/artifacts/definitions/Linux/Detection/Yara/Process.yaml +++ b/artifacts/definitions/Linux/Detection/Yara/Process.yaml @@ -92,16 +92,16 @@ sources: Meta, String.Name as YaraString, String.Offset as HitOffset, - upload( accessor='scope', - file='String.Data', - name=format(format="%v-%v_%v_%v", + upload( accessor='scope', + file='String.Data', + name=format(format="%v-%v_%v_%v", args=[ ProcessName, Pid, String.Offset, ContextBytes ] )) as HitContext FROM proc_yara( pid=Pid, rules=yara_rules, context=ContextBytes, - number=NumberOfHits + number=NumberOfHits ) }) @@ -122,4 +122,4 @@ sources: column_types: - name: HitContext - type: preview_upload \ No newline at end of file + type: preview_upload diff --git a/artifacts/definitions/Linux/Sys/LastUserLogin.yaml b/artifacts/definitions/Linux/Sys/LastUserLogin.yaml index 9da947bd8f2..9770c002e55 100644 --- a/artifacts/definitions/Linux/Sys/LastUserLogin.yaml +++ b/artifacts/definitions/Linux/Sys/LastUserLogin.yaml @@ -1,6 +1,8 @@ name: Linux.Sys.LastUserLogin -description: Find and parse system wtmp files. This indicate when the - user last logged in. +description: | + Find and parse system wtmp files. This indicate when the user last + logged in. + parameters: - name: wtmpGlobs default: /var/log/wtmp* @@ -8,16 +10,35 @@ parameters: - name: MaxCount default: 10000 type: int64 - + - name: LoginType type: choices - default: "USER_PROCESS|LOGIN_PROCESS" + default: Interactive Sessions choices: - - "USER_PROCESS|LOGIN_PROCESS" - - "RUN_LVL|BOOT_TIME|INIT_PROCESS|LOGIN_PROCESS|USER_PROCESS" - description: Per default, we are only interested in interactive sessions, if you want to see more, choose the second option + - Interactive Sessions + - All Sessions + description: | + Per default, we are only interested in interactive sessions, if + you want to see more, choose the second option + + + - name: recent_x_days + default: 14 + type: int + description: | + show all logs within the last X days (default 14 days) + + - name: excluded_users + type: regex + default: "ansible|LOGIN" + description: | + List of Users (regex), you are not interested in export: | + LET FilterLookup = dict( + `Interactive Sessions`="USER_PROCESS|LOGIN_PROCESS", + `All Sessions`="RUN_LVL|BOOT_TIME|INIT_PROCESS|LOGIN_PROCESS|USER_PROCESS") + LET wtmpProfile <= ''' [ ["Header", 0, [ @@ -49,7 +70,9 @@ export: | ["ut_termination_status", 332, "int"], ["ut_exit_status", 334, "int"], ["ut_session", 336, "int"], - ["ut_timestamp", 340, "int32"], + ["ut_timestamp", 340, "Timestamp", { + "type": "uint32", + }], ["ut_ip_address", 348, "int64"], ] ] @@ -59,15 +82,22 @@ export: | sources: - precondition: | SELECT OS From info() where OS = 'linux' + query: | + LET LoginType <= get(item=FilterLookup, field=LoginType) || LoginType + LET start_time <= timestamp(epoch=now() - recent_x_days * 3600 * 24) + + LET _ <= log(message="Start time %v", args=start_time) + LET parsed = SELECT OSPath, parse_binary( filename=OSPath, profile=wtmpProfile, struct="Header" ) AS Parsed FROM glob(globs=split(string=wtmpGlobs, sep=",")) - - //In Order to combine Login/Logout into one Table, we create a logout table first + + // In Order to combine Login/Logout into one Table, we create a + // logout table first LET logout_table <= SELECT * FROM foreach(row=parsed, query={ SELECT * FROM foreach(row=Parsed.records, @@ -75,36 +105,37 @@ sources: SELECT ut_type AS logout_Type, ut_pid as logout_PID, ut_terminal as logout_Terminal, - timestamp(epoch=ut_timestamp) as logout_time - FROM scope() + ut_timestamp as logout_time + FROM scope() + WHERE logout_Type = "DEAD_PROCESS" + AND logout_time > start_time }) - }) WHERE logout_Type in "DEAD_PROCESS" - - //In Order to combine Login/Logout into one Table, we create a login table - let login_table <= SELECT * FROM foreach(row=parsed, + }) + Order by logout_time DESC + + SELECT * FROM foreach(row=parsed, query={ SELECT * FROM foreach(row=Parsed.records, query={ - SELECT OSPath, ut_type AS login_Type, + SELECT OSPath, + ut_type AS login_Type, ut_id AS login_ID, ut_pid as login_PID, ut_hostname as login_Host, ut_user as login_User, ip(netaddr4_le=ut_ip_address) AS login_IpAddr, ut_terminal as login_Terminal, - timestamp(epoch=ut_timestamp) as login_time + ut_timestamp as login_time, { + SELECT logout_time + FROM logout_table + WHERE ut_pid = logout_PID + AND ut_terminal = logout_Terminal + AND ut_timestamp < logout_time + LIMIT 1 + } AS logout_time FROM scope() + WHERE login_Type =~ LoginType + AND NOT login_User =~ excluded_users + AND login_time > start_time }) - }) WHERE login_Type =~ LoginType AND login_User != "ansible" - - //Combines both tables, so that we see, when a session started and ended, part b of the chain, is for the case there was no logout and the session is still alive - SELECT * FROM foreach(row=login_table, - query={ - SELECT login_User as User, login_Host as SourceHost, login_IpAddr as SourceIP, login_Terminal as Terminal, login_PID as PID, login_time, logout_time FROM chain( - a = {SELECT logout_time FROM logout_table - WHERE login_PID=logout_PID AND logout_Terminal=login_Terminal AND login_time