forked from Velocidex/velociraptor
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added a send event plugin (Velocidex#1179)
This allows any VQL to send any event to a server monitoring query. This allows implementing server event queries that receive information from arbitrary sources to form a kind of a service.
- Loading branch information
Showing
10 changed files
with
367 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| name: Generic.Forensic.HashLookup | ||
| description: | | ||
| This artifact is a server event artifact that collects hashes from | ||
| various sources into a central location. It is possible to follow | ||
| this artifact (e.g. with an external program using the API) to | ||
| lookup the hashes with an external service. | ||
| You can also send hashes to this artifact yourself using the | ||
| `send_event()` vql Function. For example, the following will add | ||
| hashes from the results of another artifact. | ||
| ```vql | ||
| SELECT *, send_event( | ||
| artifact="Generic.Forensic.HashLookup", | ||
| row=dict(SHA256=Sha256, ClientId=ClientId)) | ||
| FROM source() | ||
| ``` | ||
| type: SERVER_EVENT | ||
|
|
||
| sources: | ||
| - query: | | ||
| // You can add more queries to this chain to automatically | ||
| // collect more hashes. | ||
| SELECT ClientId, SHA256 FROM chain( | ||
| a={ | ||
| SELECT * FROM foreach( | ||
| row={ | ||
| SELECT ClientId, FlowId | ||
| FROM watch_monitoring(artifact="System.Flow.Completion") | ||
| WHERE Flow.artifacts_with_results =~ "System.VFS.DownloadFile" | ||
| }, query={ | ||
| SELECT ClientId, Sha256 AS SHA256 | ||
| FROM source( | ||
| artifact="System.VFS.DownloadFile", | ||
| client_id=ClientId, flow_id=FlowId) | ||
| }) | ||
| }, async=TRUE) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| package main | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| "path/filepath" | ||
| "strings" | ||
| "time" | ||
|
|
||
| "github.com/mitchellh/panicwrap" | ||
| kingpin "gopkg.in/alecthomas/kingpin.v2" | ||
| "www.velocidex.com/golang/velociraptor/config" | ||
| ) | ||
|
|
||
| func writeLogOnPanic() { | ||
| // Figure out the log directory. | ||
| config_obj, err := new(config.Loader). | ||
| WithFileLoader(*config_path). | ||
| WithEmbedded(). | ||
| WithEnvLoader("VELOCIRAPTOR_CONFIG"). | ||
| LoadAndValidate() | ||
| kingpin.FatalIfError(err, "Unable to load config file") | ||
|
|
||
| if config_obj.Logging != nil && | ||
| config_obj.Logging.OutputDirectory != "" { | ||
| exitStatus, err := panicwrap.BasicWrap(func(output string) { | ||
| // Create a special log file in the log directory. | ||
| filename := filepath.Join( | ||
| config_obj.Logging.OutputDirectory, | ||
| fmt.Sprintf("panic-%v.log", strings.Replace(":", "_", | ||
| time.Now().Format(time.RFC3339), -1))) | ||
|
|
||
| fd, err := os.OpenFile(filename, | ||
| os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600) | ||
| if err != nil { | ||
| return | ||
| } | ||
| fd.Write([]byte(output)) | ||
| fd.Close() | ||
| }) | ||
| if err != nil { | ||
| // Something went wrong setting up the panic | ||
| // wrapper. Unlikely, but possible. | ||
| panic(err) | ||
| } | ||
|
|
||
| // If exitStatus >= 0, then we're the parent process | ||
| // and the panicwrap re-executed ourselves and | ||
| // completed. Just exit with the proper status. | ||
| if exitStatus >= 0 { | ||
| os.Exit(exitStatus) | ||
| } | ||
|
|
||
| // Otherwise, exitStatus < 0 means we're the | ||
| // child. Continue executing as normal... | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.