OSQUERY sql

 How to see all tables heading

.tables

How to see all columns fom schema

. schema tablename

 

How to see system info

select * from system_info;

How to see users

select username,uid,shell from users;

How to see a process with multi table join and suspesious and their services

select p.name,p.path,pp.name as parentname, pp.path as parentpath from processes as p left outer join processes as pp on p.parent=pp.pid order by p.name;

How to check process other than services are vulnerable

select name,pid,path,display_name from services where start_type = 'auto_start' and path not like 'C:\Windows\System32\svchost.exe -k %';

How to see install location for program

select name,install_location from programs;

How to see specific installed apps

select name,install_location from programs where name like '%brave%';

How to see user directory

select uid,username,shell,directory from users;

how to see auto startup

select name,path,source,status from startup_items where path not like '%desktop.ini%';

How to see registery data

select dATA from registry where key like '(type or copy paste registry location)';

how to see admin level users

select users.uid,users.username,shell from user_groups inner join users on user_groups.uid = users.uid where user_groups.gid = 544;

How to see browser extention

select * from chrome_extensions;

How to see browser extension permisions

select name,permissions from chrome_extensions;

How to check threats via shim based id

select executable,path,description,sdb_id from appcompat_shims;

How to check network based web server problems

select name, cwd, parent, pid from processes;

How to check network based problems on a specific app

select name, cwd, parent, pid from processes where name like '%brave.exe%';

How to check processes open from remote machine by cmdline

select name, cwd, parent, cmdline pid from processes where name like '%brave.exe%' limit 1;

How to see active listening ports

select distinct processes.pid, listening_ports.port,processes.name from processes left join listening_ports using (pid);