Pierluigi Paganini
September 28, 2016
Facebook announced to have completed the porting of its detection open-source tool OSquery to Windows. The tool allows users to monitor networks and to detect potential malicious activities, such as the presence of malicious codes.
The cross-platform tool, that is available on GitHub, was first released in 2014, but it was only supported on Ubuntu, CentOS, and Mac OS X operating systems.
Now Facebook announced the release of the Windows version of the OSquery tool.
“Today, we’re excited to announce the availability of an OSquery developer kit for Windows! Security teams can now build customized osquery solutions for their Windows networks.” reads the Facebook’s announcement.
OSquery is a component that is able to scan every machine on an infrastructure collecting a huge amount of information on their operations in real-time. Data gathered by the tool allows to quickly search for malicious behavior and eradicate the threat, for this reason, this technique is defined “threat hunting.”
“With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes. Having timely, reliable visibility into operations running throughout your network is critical to quickly identify and investigate anomalies.” continues the announcement.
Experts at Facebook suggest administrators that want to run the developer kit for Windows to check the official documentation, the tool is easy to install and use.
“The osquery developer kit for Windows includes documentation, the development environment, and a single script to get you started. Once you install the build, you can start coding right away.”
The full documentation of the development process of the developer kit for Windows is available on the blog post by Trail of Bits.
[adrotate banner=”9″]
(Security Affairs – Facebook, threat hunting)
