Search code examples
osquery

Using OSquery to modifying or kill processes, etc


From what I read osquery is used for querying / reading the system information.

By any chance it has facility to modify the system state like killing the process or deleting a registry key ??

I am using osqueryi commands like select * form users before diving in programatically.


Solution

  • Generally not.

    osquery itself aims to not change anything in the filesystem. The main distribution has no mechanisms that would do that. (Except, of course, it's local state files)

    osquery extensions, however, can be written to do whatever the extension author desires. Further, osquery supports the idea of "writeable tables" which extensions may use to present a simpler interface.

    Check out https://blog.trailofbits.com/2018/05/30/manage-your-fleets-firewalls-with-osquery/ for a writable table example.