Skip to content

[Osquery_manager] LNK artifacts saved query #16059

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tomsonpl wants to merge 11 commits into
base: temporary-osquery-artifacts-branch
Choose a base branch
from
Open

[Osquery_manager] LNK artifacts saved query #16059

Show file tree
Hide file tree
Changes from 8 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
e79165c
lnk artifact
tomsonpl Nov 20, 2025
4bf83d1
fix
tomsonpl Nov 20, 2025
222f53f
feat(osquery_manager): expand LNK forensics query with cross-reference
tomsonpl Nov 28, 2025
aa103f4
feat(osquery_manager): add YARA-based LNK detection query
tomsonpl Nov 28, 2025
b39c0ed
docs(osquery_manager): update artifacts matrix with LNK queries
tomsonpl Nov 28, 2025
091229a
Update LNK forensics query with osquery #8727 workaround and enhanced…
tomsonpl Dec 9, 2025
f9d9e66
Remove YARA-based LNK detection query
tomsonpl Dec 9, 2025
7f18def
Remove file.type ECS mapping from LNK forensics query
tomsonpl Dec 9, 2025
bcb7fc5
Simplify LNK forensics query by removing MITRE ATT&CK enrichment
tomsonpl Dec 29, 2025
011eb84
Enhance LNK forensics query with VirusTotal links and remove exclusions
tomsonpl Jan 2, 2026
d72e13c
Fix command_line
tomsonpl Jan 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions packages/osquery_manager/artifacts_matrix.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,19 +2,19 @@

This document tracks the coverage of forensic artifacts in Osquery.

**Last Updated**: 2025-11-07
**Total Core Artifacts**: 1 available + 39 in progress + 6 not available = 46 total variants
**Total Queries**: 30 (3 core forensic variants + 27 additional)
**Completion Rate**: 2.2% (1/46 core artifacts fully supported)
**Last Updated**: 2025-12-09
**Total Core Artifacts**: 2 available + 38 in progress + 6 not available = 46 total variants
**Total Queries**: 31 (4 core forensic variants + 27 additional)
**Completion Rate**: 4.3% (2/46 core artifacts fully supported)

---

## Coverage Summary

| Status | Count | Percentage |
|--------|-------|------------|
| ✅ Available (Fully Supported) | 0 | 0% |
| ⚠️ In Progress (Needs Validation) | 39 | 87.0% |
| ✅ Available (Fully Supported) | 2 | 4.3% |
| ⚠️ In Progress (Needs Validation) | 38 | 82.6% |
| ❌ Not Available (Requires Extensions) | 6 | 13.0% |

---
Expand All @@ -36,7 +36,7 @@ This document tracks the coverage of forensic artifacts in Osquery.
| 6a | Installed Services | ⚠️ | Linux | - | - | systemd table |
| 6b | Installed Services | ⚠️ | Mac | - | - | launchd table |
| 7 | Jumplists | ❌ | Win | - | - | Not natively supported — PR #7260 closed due to OLE format complexity |
| 8 | LNK files | ⚠️ | Win | - | - | shortcut_files table (deprecated), file table and recent_files table is an alternative (osquery upgrade needed for recent files) |
| 8 | LNK files | ✅ | Win | lnk_forensics_windows_elastic | [a1b2c3d4-lnk1](kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json) | Comprehensive LNK forensics across 8+ locations (user/system Startup, Desktop, Recent Items, Quick Launch, SendTo, Start Menu) using users table enumeration. Extracts full shortcut metadata (target path, target type, location, start_in, run mode, comment/arguments) using path LIKE pattern (osquery #8727 workaround). Enriched with hash and authenticode signatures for both LNK files and their targets. Detects risky executables (cmd, powershell, pwsh, wscript, cscript, rundll32, regsvr32, mshta, wmic, certutil, bitsadmin), suspicious arguments (encoded commands, download cradles, hidden windows, UNC paths), large files (>20KB), and HTTP/HTTPS strings. Includes location_type classification and intelligent result prioritization. |
| 9 | ARP Cache | ⚠️ | Win | - | - | arp_cache table |
| 9a | ARP Cache | ⚠️ | Linux | - | - | arp_cache table |
| 9b | ARP Cache | ⚠️ | Mac | - | - | arp_cache table |
Expand Down Expand Up @@ -105,6 +105,7 @@ These queries existed in the original repository and provide additional coverage
| 24 | unsigned_startup_items_vt | ✅ | Win | [b068](kibana/osquery_saved_query/osquery_manager-b0683c20-0dbb-11ed-a49c-6b13b058b135.json) | Unsigned startup items with VirusTotal integration |
| 25 | unsigned_dlls_on_system_folders_vt | ✅ | Win | [63c1](kibana/osquery_saved_query/osquery_manager-63c1fe20-176f-11ed-89c6-331eb0db6d01.json) | Unsigned DLLs in system folders with VirusTotal integration |
| 26 | executables_in_temp_folder_vt | ✅ | Win | [3e55](kibana/osquery_saved_query/osquery_manager-3e553650-17fd-11ed-89c6-331eb0db6d01.json) | Executables/drivers in temp folders with VirusTotal integration |
| 27 | lnk_forensics | ✅ | Win | [a1b2](kibana/osquery_saved_query/osquery_manager-a1b2c3d4-lnk1-11ef-8f39-bf9c07530bbb.json) | Comprehensive LNK forensics across 8+ locations with full shortcut metadata, hash, and authenticode enrichment. Uses path LIKE pattern (osquery #8727 workaround) to ensure shortcut_target_path is populated. Detects risky LOLBins, encoded commands, download cradles, HTTP/HTTPS URLs, UNC paths. Uses users table for dynamic enumeration. |

**Note**: Queries with VirusTotal integration require the VirusTotal extension configured in osquery.

Expand Down Expand Up @@ -167,7 +168,7 @@ While some artifacts are not directly available, the existing queries provide st
- ⚠️ BITS Jobs Database (Windows: via windows_eventlog)

### User Activity
- ⚠️ LNK files (Windows: shortcut_files, file, recent_files tables)
- ✅ LNK files (Windows: file table with native shortcut parsing using path LIKE pattern for full metadata + hash + authenticode enrichment + 8+ locations via users table)
- ⚠️ Shell History (Linux/Mac: shell_history table)
- ⚠️ Shellbags (Windows: shellbags table)
- ⚠️ User Assist (Windows: userassist table)
Expand Down
Loading