Skip to content

Instantly share code, notes, and snippets.

@clong

clong/query

Created September 15, 2017 23:12
Show Gist options
  • Save clong/2be104cc32e2b3cc6dfed33724a7fa3d to your computer and use it in GitHub Desktop.
Save clong/2be104cc32e2b3cc6dfed33724a7fa3d to your computer and use it in GitHub Desktop.
Download ZIP
Use osquery to find malicious pip packages
Raw
query
SELECT * FROM python_packages WHERE name = 'acqusition' OR name = 'apidev-coop' OR name = 'bzip' OR name = 'crypt' OR name = 'django-server' OR name = 'pwd' OR name = 'setup-tools' OR name = 'telnet' OR name = 'urlib3' OR name = 'urllib';
@spookerlabs
Copy link

spookerlabs commented Sep 17, 2017 •
edited
Loading

There is a small typo at urllib3

Original
osquery> SELECT * FROM python_packages WHERE name = 'acqusition' OR name = 'apidev-coop' OR name = 'bzip' OR name = 'crypt' OR name = 'django-server' OR name = 'pwd' OR name = 'setup-tools' OR name = 'telnet' OR name = 'urlib3' OR name = 'urllib';

Modified
osquery> SELECT * FROM python_packages WHERE name = 'acqusition' OR name = 'apidev-coop' OR name = 'bzip' OR name = 'crypt'
OR name = 'django-server' OR name = 'pwd' OR name = 'setup-tools' OR name = 'telnet' OR name = 'urllib3' OR name = 'urllib';
+---------+---------+------------------------------------------------------------------------+---------------+---------+----------------------------------------------------------+
| name | version | summary | author | license | path |
+---------+---------+------------------------------------------------------------------------+---------------+---------+----------------------------------------------------------+
| urllib3 | 1.22 | HTTP library with thread-safe connection pooling, file post, and more. | Andrey Petrov | MIT | /usr/lib/python2.7/site-packages/urllib3-1.22.dist-info/ |
+---------+---------+------------------------------------------------------------------------+---------------+---------+----------------------------------------------------------+
osquery>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment