Yeet the Leet with Osquery: Complementing EDR Telemetry
Sebastian Provost demonstrates using Osquery to complement EDR/XDR systems, writing SQL queries to detect open-source C2 implant payloads on endpoints.
Summary
Enhancing Endpoint Visibility with Osquery
While commercial EDR and XDR solutions provide real-time behavioral alerts, Osquery exposes an operating system as a high-performance relational database for custom querying.
Introducing Osquery for Defensive Telemetry
Sebastian Provost explains how Osquery tables represent system state—including running processes, open network sockets, loaded kernel modules, and browser extensions.
Detecting Open-Source C2 Implants with SQL Queries
Provost analyzes multiple open-source C2 frameworks (such as Mythic and Covenant), demonstrating SQL queries that detect their unique memory and disk artifacts.
Building an Open-Source Endpoint Telemetry Pipeline
The author provides defensive teams with deployment configurations and scheduled query packs to integrate Osquery into centralized threat hunting pipelines.
Related talks
Main Stage·27 min
Aden Wee Jing Chung
Aden Wee Jing Chung explores you are not hiding from me .net at DEF CON China 1, examining dotnet-security and practical defenses.
Blue Team Village·17 min
Saurabh Chaudhary
Saurabh Chaudhary demonstrates crafting high-performance, modular YARA rules to detect complex malware variants and streamline threat hunting.
Blue Team Village·29 min
Anton Ovrutsky
Anton Ovrutsky demonstrates behavioral detection patterns, static parsing tools, and deobfuscation methods to hunt malicious Office VBA macros.