[Osquery_manager] File Hash Info artifact saved query #16492

tomsonpl · 2025-12-10T09:12:33Z

File Hash Information Artifact

The File Hash Information artifact provides comprehensive file enumeration with hash values and code signature validation across staging, temporary, and persistence directories. This enables detection of suspicious files, malware staging, hidden files, and unsigned binaries - critical for identifying ingress tool transfer, masquerading, and defense evasion techniques.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	File Hash Info	✅	Windows	file_hash_info_windows_elastic	f8e71a30	Files with hash & authenticode in staging directories
2	File Hash Info	✅	macOS	file_hash_info_darwin_elastic	a3c52b40	Files with hash & Gatekeeper signature validation
3	File Hash Info	✅	Linux	file_hash_info_linux_elastic	b7d63c50	Files with hash & container/namespace awareness

Queries by Platform

🪟 Windows - File Hash & Code Signature Analysis

Description

Enumerates files with hash values and code signature validation in common staging/temp directories on Windows. Detects suspicious files, renamed executables (via original_filename PE metadata comparison), hidden/system files, and unsigned binaries. Includes PE metadata extraction and authenticode signature verification.

Detection Focus:

Files in staging directories (Public, Temp, ProgramData, Downloads)
Renamed executables detected via original_filename mismatch
Hidden and system files (file attributes analysis)
Unsigned or untrusted code signatures
PE metadata anomalies for masquerading detection

Target Directories:

C:\Users\Public\
C:\Windows\Temp\
C:\ProgramData\
C:\Users\*\AppData\Local\Temp\
C:\Users\*\Downloads\

Result

Query returns file metadata, timestamps, hash values (MD5, SHA1, SHA256), PE version information, authenticode signature status, and visibility/rename status indicators for forensic analysis.

Platform

windows

Interval

3600 seconds (1 hour)

Query ID

file_hash_info_windows_elastic

ECS Field Mappings

event.category → ["file"]
event.type → ["info"]
event.kind → state
event.module → osquery
event.dataset → osquery.file_hash_info
host.os.type → windows
file.path → path
file.directory → directory
file.name → filename
file.size → size
file.mtime → modified_time
file.ctime → changed_time
file.created → created_time
file.accessed → accessed_time
file.uid → uid
file.gid → gid
file.mode → mode
file.inode → inode
file.attributes → attributes
file.type → type
file.pe.original_file_name → original_filename
file.pe.file_version → file_version
file.pe.product → product_version
file.hash.md5 → md5
file.hash.sha1 → sha1
file.hash.sha256 → sha256
file.code_signature.subject_name → signature_signer
file.code_signature.status → signature_status
threat.framework → MITRE ATT&CK
threat.tactic.id → ["TA0005", "TA0011"]
threat.tactic.name → ["Defense Evasion", "Command and Control"]
threat.technique.id → ["T1036", "T1036.003", "T1105", "T1564.001"]
threat.technique.name → ["Masquerading", "Masquerading: Rename System Utilities", "Ingress Tool Transfer", "Hidden Files and Directories"]
tags → ["osquery", "file_forensics", "hash_analysis", "code_signature", "mitre_t1036", "mitre_t1036_003", "mitre_t1105", "mitre_t1564_001", "windows"]

SQL Query

-- File Hash Information with Code Signature Validation - Windows (T1036, T1105, T1564.001)
-- Enumerates files in common staging/temp directories with hash values and authenticode validation
-- Detects suspicious files, renamed executables, hidden files, and unsigned binaries

SELECT
    f.path,
    f.directory,
    f.filename,
    f.size,
    f.type,
    f.attributes,
    f.original_filename,
    f.file_version,
    f.product_version,
    f.volume_serial,
    f.file_id,
    f.shortcut_target_path,
    f.uid,
    f.gid,
    f.mode,
    f.inode,
    datetime(f.btime, 'unixepoch') AS created_time,
    datetime(f.mtime, 'unixepoch') AS modified_time,
    datetime(f.atime, 'unixepoch') AS accessed_time,
    datetime(f.ctime, 'unixepoch') AS changed_time,
    h.md5,
    h.sha1,
    h.sha256,
    a.subject_name AS signature_signer,
    a.result AS signature_status,
    a.serial_number AS signature_serial,
    a.issuer_name AS signature_issuer,
    CASE
        WHEN f.attributes LIKE '%H%' THEN 'hidden'
        WHEN f.attributes LIKE '%S%' THEN 'system'
        ELSE 'normal'
    END AS file_visibility,
    CASE
        WHEN f.original_filename != '' AND f.original_filename != f.filename THEN 'renamed'
        ELSE 'original'
    END AS rename_status
FROM file f
LEFT JOIN hash h ON h.path = f.path
LEFT JOIN authenticode a ON a.path = f.path
WHERE (
    f.path LIKE 'C:\Users\Public\%'
    OR f.path LIKE 'C:\Windows\Temp\%'
    OR f.path LIKE 'C:\ProgramData\%'
    OR f.path LIKE 'C:\Users\%\AppData\Local\Temp\%'
    OR f.path LIKE 'C:\Users\%\Downloads\%'
)
AND f.type = 'regular'
AND f.size > 0

🍎 macOS - File Hash & Gatekeeper Signature Validation

Description

Enumerates files with hash values and Gatekeeper code signature validation in common staging/temp directories on macOS. Detects suspicious files, hidden files (via bsd_flags and dot-prefix naming), and unsigned binaries. Includes comprehensive signature verification via the macOS signature table.

Detection Focus:

Files in staging and persistence directories
Hidden files (bsd_flags HIDDEN or dot-prefix names)
Immutable and append-only files (unusual attributes)
Unsigned or invalid Gatekeeper signatures
User-specific LaunchAgents for persistence detection

Target Directories:

/tmp
/var/tmp
/Users/Shared
/Library/LaunchAgents
/Library/LaunchDaemons
/Library/Application Support
~/Library/LaunchAgents (per-user)

Result

Query returns file metadata, timestamps, BSD flags, hash values (MD5, SHA1, SHA256), Gatekeeper signature status, team identifier, and visibility indicators for forensic analysis.

Platform

darwin

Interval

3600 seconds (1 hour)

Query ID

file_hash_info_darwin_elastic

ECS Field Mappings

event.category → ["file"]
event.type → ["info"]
event.kind → state
event.module → osquery
event.dataset → osquery.file_hash_info
host.os.type → macos
file.path → path
file.directory → directory
file.name → filename
file.size → size
file.mtime → modified_time
file.ctime → changed_time
file.created → created_time
file.accessed → accessed_time
file.uid → uid
file.gid → gid
file.mode → mode
file.inode → inode
file.hash.md5 → md5
file.hash.sha1 → sha1
file.hash.sha256 → sha256
file.code_signature.subject_name → signature_signer
file.code_signature.status → signature_status
threat.framework → MITRE ATT&CK
threat.tactic.id → ["TA0005", "TA0011"]
threat.tactic.name → ["Defense Evasion", "Command and Control"]
threat.technique.id → ["T1036", "T1105", "T1564.001"]
threat.technique.name → ["Masquerading", "Ingress Tool Transfer", "Hidden Files and Directories"]
tags → ["osquery", "file_forensics", "hash_analysis", "code_signature", "gatekeeper", "mitre_t1036", "mitre_t1105", "mitre_t1564_001", "macos"]

SQL Query

-- File Hash Information with Code Signature Validation - macOS (T1036, T1105, T1564.001)
-- Enumerates files in common staging/temp directories with hash values and Gatekeeper signature validation
-- Detects suspicious files, hidden files (bsd_flags), and unsigned binaries

SELECT
    f.path,
    f.directory,
    f.filename,
    f.size,
    f.type,
    f.bsd_flags,
    f.uid,
    f.gid,
    f.mode,
    f.inode,
    datetime(f.btime, 'unixepoch') AS created_time,
    datetime(f.mtime, 'unixepoch') AS modified_time,
    datetime(f.atime, 'unixepoch') AS accessed_time,
    datetime(f.ctime, 'unixepoch') AS changed_time,
    h.md5,
    h.sha1,
    h.sha256,
    s.authority AS signature_signer,
    CASE
        WHEN s.signed = 1 THEN 'valid'
        WHEN s.signed = 0 THEN 'unsigned'
        ELSE 'unknown'
    END AS signature_status,
    s.identifier AS signature_identifier,
    s.cdhash AS signature_cdhash,
    s.team_identifier AS signature_team_id,
    CASE
        WHEN f.bsd_flags LIKE '%HIDDEN%' OR f.filename LIKE '.%' THEN 'hidden'
        WHEN f.bsd_flags LIKE '%IMMUTABLE%' THEN 'immutable'
        WHEN f.bsd_flags LIKE '%APPEND%' THEN 'append_only'
        ELSE 'normal'
    END AS file_visibility
FROM file f
LEFT JOIN hash h ON h.path = f.path
LEFT JOIN signature s ON s.path = f.path
WHERE f.directory IN (
    '/tmp',
    '/var/tmp',
    '/Users/Shared',
    '/Library/LaunchAgents',
    '/Library/LaunchDaemons',
    '/Library/Application Support'
)
AND f.type = 'regular'
AND f.size > 0
GROUP BY f.path
UNION
SELECT
    f.path,
    f.directory,
    f.filename,
    f.size,
    f.type,
    f.bsd_flags,
    f.uid,
    f.gid,
    f.mode,
    f.inode,
    datetime(f.btime, 'unixepoch') AS created_time,
    datetime(f.mtime, 'unixepoch') AS modified_time,
    datetime(f.atime, 'unixepoch') AS accessed_time,
    datetime(f.ctime, 'unixepoch') AS changed_time,
    h.md5,
    h.sha1,
    h.sha256,
    s.authority AS signature_signer,
    CASE
        WHEN s.signed = 1 THEN 'valid'
        WHEN s.signed = 0 THEN 'unsigned'
        ELSE 'unknown'
    END AS signature_status,
    s.identifier AS signature_identifier,
    s.cdhash AS signature_cdhash,
    s.team_identifier AS signature_team_id,
    CASE
        WHEN f.bsd_flags LIKE '%HIDDEN%' OR f.filename LIKE '.%' THEN 'hidden'
        WHEN f.bsd_flags LIKE '%IMMUTABLE%' THEN 'immutable'
        WHEN f.bsd_flags LIKE '%APPEND%' THEN 'append_only'
        ELSE 'normal'
    END AS file_visibility
FROM users u
JOIN file f ON f.directory = u.directory || '/Library/LaunchAgents'
LEFT JOIN hash h ON h.path = f.path
LEFT JOIN signature s ON s.path = f.path
WHERE u.uid >= 500
AND f.type = 'regular'
AND f.size > 0
GROUP BY f.path

🐧 Linux - File Hash & Container/Namespace Awareness

Description

Enumerates files with hash values in common staging/temp directories on Linux with container and namespace awareness. Detects suspicious files, hidden files, world-writable files, and executable permissions. Includes namespace detection via pid_with_namespace and mount_namespace_id columns for containerized environment forensics.

Detection Focus:

Files in staging and persistence directories
Hidden files (dot-prefix naming)
World-writable files (permission analysis)
Executable files in unexpected locations
Container vs host context differentiation
Cron-related persistence locations

Target Directories:

/tmp/*
/var/tmp/*
/dev/shm/*
/home/*
/opt/*
/etc/cron.d/*, /etc/cron.daily/*, /etc/cron.hourly/*
/var/spool/cron/*

Result

Query returns file metadata, timestamps, hash values (MD5, SHA1, SHA256), permission analysis, username/group resolution, and container context indicators for forensic analysis.

Platform

linux

Interval

3600 seconds (1 hour)

Query ID

file_hash_info_linux_elastic

ECS Field Mappings

event.category → ["file"]
event.type → ["info"]
event.kind → state
event.module → osquery
event.dataset → osquery.file_hash_info
host.os.type → linux
file.path → path
file.directory → directory
file.name → filename
file.size → size
file.mtime → modified_time
file.ctime → changed_time
file.accessed → accessed_time
file.uid → uid
file.gid → gid
file.mode → mode
file.inode → inode
file.hash.md5 → md5
file.hash.sha1 → sha1
file.hash.sha256 → sha256
user.name → username
user.group.name → groupname
threat.framework → MITRE ATT&CK
threat.tactic.id → ["TA0005", "TA0011", "TA0040"]
threat.tactic.name → ["Defense Evasion", "Command and Control", "Impact"]
threat.technique.id → ["T1036", "T1105", "T1565.001"]
threat.technique.name → ["Masquerading", "Ingress Tool Transfer", "Stored Data Manipulation"]
tags → ["osquery", "file_forensics", "hash_analysis", "container_aware", "namespace", "mitre_t1036", "mitre_t1105", "mitre_t1565_001", "linux"]

SQL Query

-- File Hash Information with Container/Namespace Awareness - Linux (T1036, T1105, T1565.001)
-- Enumerates files in common staging/temp directories with hash values
-- Includes container awareness via pid_with_namespace and mount_namespace_id
-- Useful for detecting containerized file access and suspicious binaries

SELECT
    f.path,
    f.directory,
    f.filename,
    f.size,
    f.type,
    f.pid_with_namespace,
    f.mount_namespace_id,
    f.uid,
    f.gid,
    f.mode,
    f.inode,
    f.device,
    f.hard_links,
    f.symlink,
    f.symlink_target_path,
    u.username,
    g.groupname,
    CASE WHEN f.btime > 0 THEN datetime(f.btime, 'unixepoch') ELSE NULL END AS created_time,
    datetime(f.mtime, 'unixepoch') AS modified_time,
    datetime(f.atime, 'unixepoch') AS accessed_time,
    datetime(f.ctime, 'unixepoch') AS changed_time,
    h.md5,
    h.sha1,
    h.sha256,
    CASE
        WHEN f.filename LIKE '.%' AND (CAST(SUBSTR(f.mode, -1, 1) AS INTEGER) & 2) > 0 THEN 'hidden_world_writable'
        WHEN f.filename LIKE '.%' THEN 'hidden'
        WHEN (CAST(SUBSTR(f.mode, -1, 1) AS INTEGER) & 2) > 0 THEN 'world_writable'
        ELSE 'normal'
    END AS file_visibility,
    LENGTH(f.mode) AS mode_length,
    SUBSTR(f.mode, -1, 1) AS mode_digit_other,
    SUBSTR(f.mode, -2, 1) AS mode_digit_group,
    SUBSTR(f.mode, -3, 1) AS mode_digit_owner,
    CASE
        WHEN (CAST(SUBSTR(f.mode, -1, 1) AS INTEGER) & 1) > 0 THEN 'executable'
        WHEN (CAST(SUBSTR(f.mode, -2, 1) AS INTEGER) & 1) > 0 THEN 'executable'
        WHEN (CAST(SUBSTR(f.mode, -3, 1) AS INTEGER) & 1) > 0 THEN 'executable'
        ELSE 'not_executable'
    END AS executable_status,
    CASE
        WHEN f.mount_namespace_id != '' AND f.mount_namespace_id IS NOT NULL THEN 'containerized'
        ELSE 'host'
    END AS container_context
FROM file f
LEFT JOIN hash h ON h.path = TRIM(f.path)
LEFT JOIN users u ON u.uid = f.uid
LEFT JOIN groups g ON g.gid = f.gid
WHERE (
    f.path LIKE '/tmp/%'
    OR f.path LIKE '/var/tmp/%'
    OR f.path LIKE '/dev/shm/%'
    OR f.path LIKE '/home/%'
    OR f.path LIKE '/opt/%'
    OR f.path LIKE '/etc/cron.d/%'
    OR f.path LIKE '/etc/cron.daily/%'
    OR f.path LIKE '/etc/cron.hourly/%'
    OR f.path LIKE '/var/spool/cron/%'
)
AND f.type = 'regular'
AND f.size > 0

- Add file_hash_info_windows_elastic: Files with hash & authenticode in staging directories - Add file_hash_info_darwin_elastic: Files with hash & Gatekeeper signature validation - Add file_hash_info_linux_elastic: Files with hash & container/namespace awareness - Add MITRE ATT&CK coverage: T1036, T1036.003, T1105, T1564.001, T1565.001 - Enhance ECS mappings with file.*, event.*, threat.* fields - Update artifacts_matrix.md: 4 artifacts now available (8.7% completion) - Update coreMigrationVersion to 9.2.0

elasticmachine · 2025-12-10T09:31:41Z

💚 Build Succeeded

Buildkite Build
Commit: de7cc0b

raqueltabuyo · 2025-12-15T11:44:35Z

@tomsonpl Can you add another query for file hashes without any filtering? Same as you did for file directory listing.Would be good to get a whole list of files with hashes, without any filters. There could be cases where malware is stored in other locations apart from those listed there.

ferullo · 2025-12-15T18:37:36Z

...manager/kibana/osquery_saved_query/osquery_manager-b7d63c50-b623-11ef-9c4a-8b2c7c5a1d40.json

+        "id": "file_hash_info_linux_elastic",
+        "interval": "3600",
+        "platform": "linux",
+        "query": "-- File Hash Information with Container/Namespace Awareness - Linux (T1036, T1105, T1565.001)\n-- Enumerates files in common staging/temp directories with hash values\n-- Includes container awareness via pid_with_namespace and mount_namespace_id\n-- Useful for detecting containerized file access and suspicious binaries\n\nSELECT\n    f.path,\n    f.directory,\n    f.filename,\n    f.size,\n    f.type,\n    f.pid_with_namespace,\n    f.mount_namespace_id,\n    f.uid,\n    f.gid,\n    f.mode,\n    f.inode,\n    f.device,\n    f.hard_links,\n    f.symlink,\n    f.symlink_target_path,\n    u.username,\n    g.groupname,\n    CASE WHEN f.btime > 0 THEN datetime(f.btime, 'unixepoch') ELSE NULL END AS created_time,\n    datetime(f.mtime, 'unixepoch') AS modified_time,\n    datetime(f.atime, 'unixepoch') AS accessed_time,\n    datetime(f.ctime, 'unixepoch') AS changed_time,\n    h.md5,\n    h.sha1,\n    h.sha256,\n    CASE\n        WHEN f.filename LIKE '.%' AND (CAST(SUBSTR(f.mode, -1, 1) AS INTEGER) & 2) > 0 THEN 'hidden_world_writable'\n        WHEN f.filename LIKE '.%' THEN 'hidden'\n        WHEN (CAST(SUBSTR(f.mode, -1, 1) AS INTEGER) & 2) > 0 THEN 'world_writable'\n        ELSE 'normal'\n    END AS file_visibility,\n    LENGTH(f.mode) AS mode_length,\n    SUBSTR(f.mode, -1, 1) AS mode_digit_other,\n    SUBSTR(f.mode, -2, 1) AS mode_digit_group,\n    SUBSTR(f.mode, -3, 1) AS mode_digit_owner,\n    CASE\n        WHEN (CAST(SUBSTR(f.mode, -1, 1) AS INTEGER) & 1) > 0 THEN 'executable'\n        WHEN (CAST(SUBSTR(f.mode, -2, 1) AS INTEGER) & 1) > 0 THEN 'executable'\n        WHEN (CAST(SUBSTR(f.mode, -3, 1) AS INTEGER) & 1) > 0 THEN 'executable'\n        ELSE 'not_executable'\n    END AS executable_status,\n    CASE\n        WHEN f.mount_namespace_id != '' AND f.mount_namespace_id IS NOT NULL THEN 'containerized'\n        ELSE 'host'\n    END AS container_context\nFROM file f\nLEFT JOIN hash h ON h.path = TRIM(f.path)\nLEFT JOIN users u ON u.uid = f.uid\nLEFT JOIN groups g ON g.gid = f.gid\nWHERE (\n    f.path LIKE '/tmp/%'\n    OR f.path LIKE '/var/tmp/%'\n    OR f.path LIKE '/dev/shm/%'\n    OR f.path LIKE '/home/%'\n    OR f.path LIKE '/opt/%'\n    OR f.path LIKE '/etc/cron.d/%'\n    OR f.path LIKE '/etc/cron.daily/%'\n    OR f.path LIKE '/etc/cron.hourly/%'\n    OR f.path LIKE '/var/spool/cron/%'\n)\nAND f.type = 'regular'\nAND f.size > 0",


This didn't work as is for me with Osquerybeat 9.1.2

ferullo · 2025-12-15T18:41:36Z

...manager/kibana/osquery_saved_query/osquery_manager-b7d63c50-b623-11ef-9c4a-8b2c7c5a1d40.json

+            {
+                "key": "threat.technique.name",
+                "value": {
+                    "value": ["Masquerading", "Ingress Tool Transfer", "Stored Data Manipulation"]


I haven't been reviewing the fields under threat.* because I'm not really sure what they should be but I noticed these and they don't seem right. @calladoum-elastic have you been reviewing them?

Do they all need review? Do we need to include them in the first place?

ferullo · 2025-12-15T18:45:53Z

...manager/kibana/osquery_saved_query/osquery_manager-f8e71a30-b621-11ef-9c4a-8b2c7c5a1d3e.json

+                }
+            },
+            {
+                "key": "file.attributes",


ECS says this should be an array of values not a single string. Does that matter?

tomsonpl marked this pull request as ready for review December 10, 2025 09:26

tomsonpl requested a review from a team as a code owner December 10, 2025 09:26

tomsonpl requested review from parkiino and szwarckonrad and removed request for a team December 10, 2025 09:26

andrewkroh added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. Integration:osquery_manager Osquery Manager Team:Defend Workflows Security team for Endpoint and OSQuery workflows [elastic/security-defend-workflows] labels Dec 10, 2025

ferullo reviewed Dec 15, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[Osquery_manager] File Hash Info artifact saved query #16492

[Osquery_manager] File Hash Info artifact saved query #16492

tomsonpl commented Dec 10, 2025

Uh oh!

elasticmachine commented Dec 10, 2025

Uh oh!

raqueltabuyo commented Dec 15, 2025 •

edited

Loading

Uh oh!

ferullo Dec 15, 2025

Uh oh!

ferullo Dec 15, 2025

Uh oh!

ferullo Dec 15, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

[Osquery_manager] File Hash Info artifact saved query #16492

Are you sure you want to change the base?

[Osquery_manager] File Hash Info artifact saved query #16492

Conversation

tomsonpl commented Dec 10, 2025

File Hash Information Artifact

Core Forensic Artifacts Coverage

Queries by Platform

Description

Result

Platform

Interval

Query ID

ECS Field Mappings

SQL Query

Description

Result

Platform

Interval

Query ID

ECS Field Mappings

SQL Query

Description

Result

Platform

Interval

Query ID

ECS Field Mappings

SQL Query

Uh oh!

elasticmachine commented Dec 10, 2025

💚 Build Succeeded

Uh oh!

raqueltabuyo commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ferullo Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

ferullo Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

ferullo Dec 15, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

raqueltabuyo commented Dec 15, 2025 •

edited

Loading