{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/3716","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/3716/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/3716/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/3716/events","html_url":"https://github.com/facebook/osquery/pull/3716","id":259643289,"number":3716,"title":"[WIP] Authenticode verification support for Windows (similar to the 'signature' table on macOS)","user":{"login":"alessandrogario","id":5714290,"avatar_url":"https://avatars0.githubusercontent.com/u/5714290?v=4","gravatar_id":"","url":"https://api.github.com/users/alessandrogario","html_url":"https://github.com/alessandrogario","followers_url":"https://api.github.com/users/alessandrogario/followers","following_url":"https://api.github.com/users/alessandrogario/following{/other_user}","gists_url":"https://api.github.com/users/alessandrogario/gists{/gist_id}","starred_url":"https://api.github.com/users/alessandrogario/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alessandrogario/subscriptions","organizations_url":"https://api.github.com/users/alessandrogario/orgs","repos_url":"https://api.github.com/users/alessandrogario/repos","events_url":"https://api.github.com/users/alessandrogario/events{/privacy}","received_events_url":"https://api.github.com/users/alessandrogario/received_events","type":"User","site_admin":false},"labels":[{"id":196858822,"url":"https://api.github.com/repos/facebook/osquery/labels/CLA%20Signed","name":"CLA Signed","color":"009900","default":false},{"id":118805314,"url":"https://api.github.com/repos/facebook/osquery/labels/virtual%20tables","name":"virtual tables","color":"207de5","default":false},{"id":337332432,"url":"https://api.github.com/repos/facebook/osquery/labels/Windows","name":"Windows","color":"d4c5f9","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2017-09-21T21:49:54Z","updated_at":"2017-09-30T13:55:54Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/3716","html_url":"https://github.com/facebook/osquery/pull/3716","diff_url":"https://github.com/facebook/osquery/pull/3716.diff","patch_url":"https://github.com/facebook/osquery/pull/3716.patch"},"body":"## Goal\r\nThis PR aims to add Authenticode verification support to osquery in a similar way to the 'signature' virtual table that has been implemented for macOS.\r\n\r\n## Changes\r\nI have defined a 'signature' virtual table for Windows; it only sports two columns for now, but I plan on adding more. I'm using a more verbose field instead of the 'signed' boolean used in the macOS implementation.\r\n\r\nThe following are the possible states:\r\n* **missing**: Missing signature.\r\n* **invalid**: An invalid signature, caused by missing or broken files.\r\n* **untrusted**: A signature that could not be validated.\r\n* **distrusted**: A valid signature, explicitly distrusted by the user.\r\n* **valid**: A valid signature which is not explicitly trusted by the user.\r\n* **trusted**: A valid signature, trusted by the user.\r\n\r\n## Examples\r\n\r\n### Verifying the authenticode signature for running executables\r\n\r\n```sql\r\nSELECT process.pid, process.path, authenticode.result\r\nFROM processes as process\r\nLEFT JOIN signature AS authenticode\r\nON process.path = authenticode.path;\r\n```\r\n\r\n```\r\n...\r\n| 5124 | C:\\Windows\\system32\\winlogon.exe    | missing |\r\n| 2476 | C:\\Windows\\system32\\dwm.exe         | missing |\r\n| 2744 | C:\\Windows\\system32\\fontdrvhost.exe | trusted |\r\n| 6372 | c:\\windows\\system32\\sihost.exe      | missing |\r\n| 7152 | c:\\windows\\system32\\svchost.exe     | trusted |\r\n| 80   | c:\\windows\\system32\\svchost.exe     | trusted |\r\n| 6748 | c:\\windows\\system32\\taskhostw.exe   | trusted |\r\n...\r\n```\r\n\r\n### Listing unsigned/untrusted processes listening for connections\r\n```sql\r\nSELECT port_info.pid, port_info.family, port_info.protocol, port_info.port, port_info.address,\r\n       process.name, process.path,\r\n       authenticode.result AS authenticode\r\n\r\nFROM listening_ports AS port_info\r\n\r\nLEFT JOIN processes\r\nAS process ON port_info.pid = process.pid\r\n\r\nLEFT JOIN signature AS authenticode\r\nON process.path = authenticode.path\r\n\r\nWHERE authenticode <> \"trusted\";\r\n```\r\n```\r\n\r\n\r\n+------+--------+----------+-------+---------+-------------+------------------------------------+--------------+\r\n| pid  | family | protocol | port  | address | name        | path                               | authenticode |\r\n+------+--------+----------+-------+---------+-------------+------------------------------------+--------------+\r\n| 6588 | 2      | 6        | 80    | 0.0.0.0 | hfs.exe     | C:\\Program Files (x86)\\HFS\\hfs.exe | missing      |\r\n| 1724 | 2      | 6        | 49667 | 0.0.0.0 | spoolsv.exe | C:\\Windows\\System32\\spoolsv.exe    | missing      |\r\n| 1724 | 23     | 6        | 49667 | ::      | spoolsv.exe | C:\\Windows\\System32\\spoolsv.exe    | missing      |\r\n+------+--------+----------+-------+---------+-------------+------------------------------------+--------------+\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/333310178","html_url":"https://github.com/facebook/osquery/pull/3716#issuecomment-333310178","issue_url":"https://api.github.com/repos/facebook/osquery/issues/3716","id":333310178,"user":{"login":"facebook-github-bot","id":6422482,"avatar_url":"https://avatars3.githubusercontent.com/u/6422482?v=4","gravatar_id":"","url":"https://api.github.com/users/facebook-github-bot","html_url":"https://github.com/facebook-github-bot","followers_url":"https://api.github.com/users/facebook-github-bot/followers","following_url":"https://api.github.com/users/facebook-github-bot/following{/other_user}","gists_url":"https://api.github.com/users/facebook-github-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/facebook-github-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/facebook-github-bot/subscriptions","organizations_url":"https://api.github.com/users/facebook-github-bot/orgs","repos_url":"https://api.github.com/users/facebook-github-bot/repos","events_url":"https://api.github.com/users/facebook-github-bot/events{/privacy}","received_events_url":"https://api.github.com/users/facebook-github-bot/received_events","type":"User","site_admin":false},"created_at":"2017-09-30T13:55:54Z","updated_at":"2017-09-30T13:55:54Z","author_association":"NONE","body":"[@alessandrogario](https://github.com/alessandrogario) has updated the pull request. View: [changes](https://github.com/facebook/osquery/pull/3716/files/c8078858f3f21f593addbe1f3584ee2adc8247f4..41e17ec849c41bbac0642cb21dd024d0717d976e)"}}
{"actor":{"display_login":"facebook-github-bot"}}