TryHackMe! Finding Computer Artifacts with osquery
Source: YouTube · John Hammond · published Jul 3, 2023 · 20:06
OSquery is an open-source Facebook-created tool that converts operating systems into queryable databases, allowing security professionals to interrogate endpoints using SQL-like commands. 00:00
Key Takeaways:
• OSquery provides security analysts with a powerful tool to query system information like processes, services, and files using SQL-like syntax 00:00
• The interactive mode of OSquery uses meta-commands like ".tables" and ".schema" to explore available data structures and their fields 00:00
• OSquery is particularly valuable for digital forensics and incident response, as it can help find evidence of process execution and installed applications 00:00
The TryHackMe environment demonstrated in this video provides an accessible way for security professionals to gain hands-on experience with OSquery's capabilities.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
there are a whole lot of ways to interrogate data and information from an endpoint a device from a machine from a computer and one of the coolest ways to do that is to treat the whole operating system like a database and in this video we're going to play with that I want to showcase OS query within a try hack me room or exercise or lab or environment that we can play with it and it's already all spun up and installed for us I'll include a link in the video description but if you are online on tryhackme.com and you move into the learn section you can take a look at some of the different learning paths whether or not you're getting into offensive security or defensive security red teaming or blue teaming all the things you could learn to get into cyber security in this video we're gonna go e…