[Osquery_manager] Services artifacts saved queries

[tomsonpl]

Services Artifact - Suspicious Service Persistence Detection

The Services artifact provides comprehensive visibility into system service configurations across Windows, macOS, and Linux platforms. These queries identify suspicious services that may indicate persistence mechanisms, privilege escalation, or lateral movement by analyzing service executables, code signatures, file locations, and configuration anomalies.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	Services (Suspicious)	✅	Windows	services_suspicious_windows_elastic	892ee425	Windows service persistence with signature validation, ServiceDLL hijacking, and FailureCommand detection
2	Services (Suspicious)	✅	macOS	services_suspicious_darwin_elastic	5823a22e	macOS launchd persistence with code signature analysis and suspicious path detection
3	Services (Suspicious)	✅	Linux	services_suspicious_linux_elastic	f8b0894b	Linux systemd service persistence in non-standard locations

Queries by Platform

---

🪟 Windows - Suspicious Service Persistence Detection

Description

Identifies suspicious Windows services using multiple risk indicators: unsigned/untrusted binaries, executables in user-writable directories (Users, AppData, Temp, ProgramData), FailureCommand persistence mechanisms, and ServiceDLL hijacking with untrusted DLLs. Results prioritized by risk level. Covers MITRE ATT&CK T1543.003 (Windows Service), T1574.011 (Services Registry Permissions Weakness), T1112 (Modify Registry).

Detection Focus:

• Services with unsigned or untrusted executables
• Executables running from user-writable paths (Users, AppData, Temp, ProgramData)
• FailureCommand registry entries for persistence
• ServiceDLL hijacking with untrusted DLLs
• Registry modification timestamps for timeline analysis

Result

[Query results will show suspicious services with their executable paths, code signature status, ServiceDLL information, and failure command configurations prioritized by risk level]

Platform

windows

Interval

3600 seconds (1 hour)

Query ID

services_suspicious_windows_elastic

ECS Field Mappings

• event.category → ["configuration"]
• event.type → ["info"]
• event.kind → state
• event.module → osquery
• event.dataset → osquery.windows_services
• host.os.type → windows
• service.name → name
• service.state → status
• process.command_line → cmdline
• process.executable → exe_path
• process.pid → pid
• user.name → user_account
• process.hash.sha256 → sha256
• process.code_signature.subject_name → signature_signer
• process.code_signature.status → signature_status
• registry.path → registry_path
• file.mtime → modified_time
• dll.path → service_dll
• dll.hash.sha256 → dll_sha256
• dll.code_signature.status → dll_signature_status
• tags → ["persistence", "threat_hunting", "services", "windows", "mitre_t1543_003", "mitre_t1574_011"]
• threat.framework → MITRE ATT&CK
• threat.tactic.id → ["TA0003", "TA0004"]
• threat.tactic.name → ["Persistence", "Privilege Escalation"]
• threat.technique.id → ["T1543.003", "T1574.011"]
• threat.technique.name → ["Create or Modify System Process: Windows Service", "Hijack Execution Flow: Services Registry Permissions Weakness"]

SQL Query

-- Windows Service Persistence Detection
-- Identifies suspicious services based on signature, path, and persistence indicators
-- T1543.003 (Windows Service), T1574.011 (ServiceDLL Hijacking)

WITH services_base AS (
  SELECT
    s.name,
    s.display_name,
    s.path AS cmdline,
    CASE
      WHEN s.path LIKE '"%' THEN
        SUBSTR(s.path, 2, INSTR(SUBSTR(s.path, 2), '"') - 1)
      WHEN INSTR(LOWER(s.path), '.exe ') > 0 THEN
        SUBSTR(s.path, 1, INSTR(LOWER(s.path), '.exe') + 3)
      WHEN INSTR(LOWER(s.path), '.sys ') > 0 THEN
        SUBSTR(s.path, 1, INSTR(LOWER(s.path), '.sys') + 3)
      ELSE s.path
    END AS exe_path,
    s.status,
    s.start_type,
    s.user_account,
    s.service_type,
    s.pid,
    'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\' || s.name AS registry_path,
    r_key.mtime AS registry_mtime,
    r_dll.data AS service_dll,
    r_failcmd.data AS failure_command
  FROM services s
  LEFT JOIN registry r_key
    ON r_key.key = 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\' || s.name
    AND r_key.name = 'Start'
  LEFT JOIN registry r_dll
    ON r_dll.key = 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\' || s.name || '\Parameters'
    AND r_dll.name = 'ServiceDll'
  LEFT JOIN registry r_failcmd
    ON r_failcmd.key = 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\' || s.name
    AND r_failcmd.name = 'FailureCommand'
  WHERE s.service_type NOT LIKE '%DRIVER%'
    AND s.path IS NOT NULL
    AND s.path != ''
),
services_enriched AS (
  SELECT
    sb.*,
    datetime(sb.registry_mtime, 'unixepoch') AS modified_time,
    CAST((strftime('%s', 'now') - sb.registry_mtime) / 86400 AS INTEGER) AS days_since_modified,
    (SELECT sha256 FROM hash WHERE path = sb.exe_path LIMIT 1) AS sha256,
    (SELECT subject_name FROM authenticode WHERE path = sb.exe_path LIMIT 1) AS signature_signer,
    (SELECT result FROM authenticode WHERE path = sb.exe_path LIMIT 1) AS signature_status,
    CASE WHEN sb.service_dll IS NOT NULL AND sb.service_dll != '' THEN
      (SELECT sha256 FROM hash WHERE path = sb.service_dll LIMIT 1)
    END AS dll_sha256,
    CASE WHEN sb.service_dll IS NOT NULL AND sb.service_dll != '' THEN
      (SELECT result FROM authenticode WHERE path = sb.service_dll LIMIT 1)
    END AS dll_signature_status
  FROM services_base sb
)

SELECT *
FROM services_enriched
WHERE (
  (signature_status IS NULL OR signature_status != 'trusted')
  OR exe_path LIKE 'C:\\Users\\%'
  OR exe_path LIKE '%\\AppData\\%'
  OR exe_path LIKE '%\\Temp\\%'
  OR exe_path LIKE 'C:\\Temp\\%'
  OR exe_path LIKE 'C:\\ProgramData\\%'
  OR failure_command IS NOT NULL
  OR (service_dll IS NOT NULL AND (dll_signature_status IS NULL OR dll_signature_status != 'trusted'))
)
ORDER BY
  CASE WHEN signature_status IS NULL OR signature_status != 'trusted' THEN 0 ELSE 1 END,
  CASE WHEN failure_command IS NOT NULL THEN 0 ELSE 1 END,
  CASE WHEN exe_path LIKE 'C:\\Users\\%' OR exe_path LIKE '%\\Temp\\%' THEN 0 ELSE 1 END;

---

🍎 macOS - LaunchD Persistence Detection

Description

Identifies third-party macOS launchd persistence mechanisms and Apple-signed services in suspicious locations. Enumerates non-Apple-signed services for threat hunting, flags Apple-signed binaries executing from user-writable paths (/Users/, /tmp/, hidden directories). Derives executable from program or program_arguments fields, enriches with code signature validation and file hashes. Excludes trusted system paths (/System/, /Library/Apple/). Covers MITRE ATT&CK T1543.001 (Launch Agent) and T1543.004 (Launch Daemon).

Detection Focus:

• Non-Apple-signed launchd services (Launch Agents and Daemons)
• Apple-signed binaries executing from suspicious user-writable paths
• Services with executables in /Users/, /tmp/, or hidden directories
• Third-party persistence mechanisms in Library directories
• Code signature validation and hash enrichment for threat intelligence

Result

[Query results will show suspicious launchd services with their labels, executable paths, code signatures, and file hashes sorted by signature status and launchd type]

Platform

darwin

Interval

3600 seconds (1 hour)

Query ID

services_suspicious_darwin_elastic

ECS Field Mappings

• event.category → ["configuration"]
• event.type → ["info"]
• event.kind → state
• event.module → osquery
• event.dataset → osquery.launchd_services
• host.os.type → macos
• service.name → label
• file.path → path
• process.executable → executable_path
• process.command_line → program_arguments
• user.name → username
• process.hash.md5 → md5
• process.hash.sha256 → sha256
• process.code_signature.subject_name → signature_signer
• process.code_signature.status → signature_status
• tags → ["persistence", "threat_hunting", "launchd", "macos", "mitre_t1543_001", "mitre_t1543_004"]
• threat.framework → MITRE ATT&CK
• threat.tactic.id → ["TA0003"]
• threat.tactic.name → ["Persistence"]
• threat.technique.id → ["T1543.001", "T1543.004"]
• threat.technique.name → ["Create or Modify System Process: Launch Agent", "Create or Modify System Process: Launch Daemon"]

SQL Query

-- macOS LaunchD Persistence Detection
-- Enumerates non-Apple and suspicious launchd services for threat hunting
-- T1543.001 (Launch Agent), T1543.004 (Launch Daemon)

WITH services_base AS (
  SELECT
    l.label,
    l.name,
    l.path,
    l.program,
    l.program_arguments,
    l.run_at_load,
    l.keep_alive,
    COALESCE(NULLIF(l.username, ''), 'root') AS username,
    CASE
      WHEN l.program IS NOT NULL AND l.program != '' THEN l.program
      WHEN l.program_arguments IS NOT NULL AND l.program_arguments != '' THEN
        CASE
          WHEN INSTR(l.program_arguments, ' ') > 0
            THEN SUBSTR(l.program_arguments, 1, INSTR(l.program_arguments, ' ') - 1)
          ELSE l.program_arguments
        END
      ELSE NULL
    END AS executable_path,
    CASE
      WHEN l.path LIKE '/Library/LaunchDaemons/%' THEN 'system_daemon'
      WHEN l.path LIKE '/Library/LaunchAgents/%' THEN 'system_agent'
      WHEN l.path LIKE '%/Library/LaunchAgents/%' THEN 'user_agent'
      ELSE 'other'
    END AS launchd_type
  FROM launchd l
  WHERE l.path IS NOT NULL
    AND l.path != ''
),
services_enriched AS (
  SELECT
    sb.*,
    (SELECT authority FROM signature WHERE path = sb.executable_path LIMIT 1) AS signature_signer,
    CASE
      WHEN (SELECT authority FROM signature WHERE path = sb.executable_path LIMIT 1) IS NOT NULL
        AND (SELECT authority FROM signature WHERE path = sb.executable_path LIMIT 1) != ''
      THEN 1 ELSE 0
    END AS is_signed,
    CASE
      WHEN (SELECT authority FROM signature WHERE path = sb.executable_path LIMIT 1) IS NOT NULL
        AND (SELECT authority FROM signature WHERE path = sb.executable_path LIMIT 1) != ''
      THEN 'signed' ELSE 'unsigned'
    END AS signature_status,
    (SELECT md5 FROM hash WHERE path = sb.executable_path LIMIT 1) AS md5,
    (SELECT sha256 FROM hash WHERE path = sb.executable_path LIMIT 1) AS sha256
  FROM services_base sb
)

SELECT *
FROM services_enriched
WHERE
  regex_match(path, '^(/System/|/Library/Apple/|/usr/libexec/)', 0) IS NULL
  AND (
    regex_match(COALESCE(signature_signer, ''), '(Apple|Software Signing)', 0) IS NULL
    OR regex_match(COALESCE(executable_path, ''), '(^/Users/|^/tmp/|^/var/tmp/|^/private/tmp/|/[.])', 0) IS NOT NULL
  )
ORDER BY
  is_signed ASC,
  launchd_type,
  label;

---

🐧 Linux - Systemd Service Persistence Detection

Description

Identifies suspicious Linux systemd service units in non-standard locations. Targets user-writable paths (/home, /tmp, /var/tmp), user systemd directories (~/.config/systemd, ~/.local/share/systemd), unusual unit states (linked, transient), recently modified units in /etc/systemd/system, and runtime-generated units in /run. Prioritizes results by risk level. Covers MITRE ATT&CK T1543.002 (Systemd Service).

Detection Focus:

• Services in user-writable paths (/home, /tmp, /var/tmp)
• User-level systemd units in ~/.config/systemd or ~/.local/share/systemd
• Linked or transient unit states indicating dynamic service creation
• Recently modified service units in /etc/systemd/system (last 30 days)
• Runtime-generated units in /run/systemd directory

Result

[Query results will show suspicious systemd service units with their paths, states, modification times, and file hashes prioritized by risk level (user-writable paths first)]

Platform

linux

Interval

3600 seconds (1 hour)

Query ID

services_suspicious_linux_elastic

ECS Field Mappings

• event.category → ["configuration"]
• event.type → ["info"]
• event.kind → state
• event.module → osquery
• event.dataset → osquery.systemd_services
• host.os.type → linux
• service.name → unit_id
• service.state → active_state
• file.path → fragment_path
• file.mtime → modified_time
• file.hash.sha256 → sha256
• tags → ["persistence", "threat_hunting", "systemd", "linux", "mitre_t1543_002"]
• threat.framework → MITRE ATT&CK
• threat.tactic.id → ["TA0003"]
• threat.tactic.name → ["Persistence"]
• threat.technique.id → ["T1543.002"]
• threat.technique.name → ["Create or Modify System Process: Systemd Service"]

SQL Query

-- Linux Systemd Service Persistence Detection
-- Identifies suspicious service units in non-standard locations
-- T1543.002 (Systemd Service)

WITH services_base AS (
  SELECT
    su.id AS unit_id,
    su.load_state,
    su.active_state,
    su.sub_state,
    su.description,
    su.unit_file_state,
    su.fragment_path,
    f.mtime,
    datetime(f.mtime, 'unixepoch') AS modified_time,
    CAST((strftime('%s', 'now') - f.mtime) / 86400 AS INTEGER) AS days_since_modified,
    (SELECT sha256 FROM hash WHERE path = su.fragment_path LIMIT 1) AS sha256
  FROM systemd_units su
  LEFT JOIN file f ON f.path = su.fragment_path
  WHERE su.id LIKE '%.service'
    AND su.fragment_path IS NOT NULL
    AND su.fragment_path != ''
)

SELECT *
FROM services_base
WHERE (
  fragment_path LIKE '/home/%'
  OR fragment_path LIKE '/root/%'
  OR fragment_path LIKE '/tmp/%'
  OR fragment_path LIKE '/var/tmp/%'
  OR fragment_path LIKE '%/.config/systemd/%'
  OR fragment_path LIKE '%/.local/share/systemd/%'
  OR unit_file_state IN ('linked', 'linked-runtime', 'transient')
  OR (fragment_path LIKE '/etc/systemd/system/%' AND days_since_modified < 30)
  OR fragment_path LIKE '/run/systemd/%'
)
ORDER BY
  CASE WHEN fragment_path LIKE '/home/%' OR fragment_path LIKE '/tmp/%' THEN 0 ELSE 1 END,
  CASE WHEN fragment_path LIKE '%/.config/systemd/%' THEN 0 ELSE 1 END,
  days_since_modified ASC;

---

MITRE ATT&CK Coverage Summary

Technique ID	Technique Name	Platform
T1543.003	Create or Modify System Process: Windows Service	Windows
T1574.011	Hijack Execution Flow: Services Registry Permissions Weakness	Windows
T1543.001	Create or Modify System Process: Launch Agent	macOS
T1543.004	Create or Modify System Process: Launch Daemon	macOS
T1543.002	Create or Modify System Process: Systemd Service	Linux

---

This PR was AI assisted with Claude Code

[ferullo]

Did you see results for all the Windows columns? I ran the Windows query and the failure_*, service_dll, servicedll_* fields were always empty for me.

[ferullo]

This is not the path, it is the command line to run. I think it should go under process.command_line and the table column should be something like cmd. Check out the Elastic Endpoint service result for an example of what I mean.

[ferullo]

Sorry to keep leaving disjoint comments...

Windows registry and file paths are case insensitive. Should that be accounted for in the query?

[tomsonpl]

Thanks @ferullo - I totally forgot about your comments, I'll review them on Monday :)

[raqueltabuyo]

QQ - In terms of the query itself, why the failure commands are considered for persistence?

[tomsonpl]

Did you see results for all the Windows columns? I ran the Windows query and the failure_*, service_dll, servicedll_* fields were always empty for me.

I adjusted the query a bit, and also reproduced failure attack and some dlls on my machine. The data is there - now available on the screenshots.

[ferullo]

I tried to offer an SQL update diff but I kept hitting a wall putting my thoughts into code so I'll just leave this comment for now.

1. Can we modify this to return all (1) non-Apple services and (2) all services, even if signed by Apple, run from suspicious locations (for both, regardless of whether they run at load)? That seems a small superset of what this query currently returns.
2. Lots of services seem to have a NULL program because the program is actually found in program_arguments. Those services appear unsigned because signatures are only checked against program in the WITH clause.

[tomsonpl]

Hey @ferullo, thanks - these are great tips 👍

I think I understood your suggestions, but please tell me if you think there's still something that needs adjustments.

Changes:

1. Broader scope: Query now returns ALL non-Apple-signed services regardless of run_at_load, plus Apple-signed services (Software Signing) running from suspicious locations (/tmp/, /Users/, /var/tmp/, hidden /. directories)
2. Fixed NULL program: Added executable_path derivation that extracts from program first, falls back to first element of program_arguments when program is NULL. Signature and hash lookups now use this derived path.

[ferullo]

Nice. This is obviously a lot of work.

[ferullo]

This should be process.command_line

process.args is an array, process.command_line is the joined string.

[ferullo]

These should be under process.* not file.*. file.path is the path to the service configuration file but these hashes are for the process executable.

[ferullo]

In the below snippet the actual criteria doesn't match the comment. If we just want to return new services I guess update the comment and we can just remove the fragment path check?

 -- MEDIUM RISK: Service in /etc/systemd but not standard package install
 OR (fragment_path LIKE '/etc/systemd/system/%' AND days_since_modified < 30)

Also, the hashes are for the service file itself not the executable that's run unlike on macOS (I haven't checked which Windows does). Since the executable path isn't included I assume you just can't retrieve it to join against? In that case can we just drop the hash in this table?

[tomsonpl]

good point, removed the comment, and the hash 👍

[ferullo]

consider renaming cert_subject to signature_subject for consistency within this query or signer for consistency with macOS.

[ferullo]

This column doesn't seem to be what ECS says service.type should be and it feels different from the type of data being put in this column on macOS. Maybe just drop mapping this column?

[ferullo]

I think these should move from file.* to process.* since they correspond to the process.executable binary and on macOS file.path is being used for the service configuration file.

[ferullo]

How about changing this snippet to drop the exe_path checks. There's nothing special about c:\windows, malware could place itself in that directory.

 -- HIGH RISK: Unsigned or untrusted binary (not in trusted paths)
 ((signature_status IS NULL OR signature_status != 'trusted')
 AND exe_path NOT LIKE 'C:\\Windows\\System32\\%'
 AND exe_path NOT LIKE 'C:\\Windows\\SysWOW64\\%')

[ferullo]

This comes back as seconds since epoch. IMO it would be cool if in the query results the type was a date string. Especially since for Windows it seems the time is a data string and it seems friendlier for the times to always be the same format across OSes and queries.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: a65b39f

History

• 💚 Build #35943 succeeded 9772cd9
• 💔 Build #35940 failed fc3431b
• 💚 Build #35279 succeeded 0e4622f
• 💚 Build #35151 succeeded 440f326
• 💚 Build #35149 succeeded 0eb3b1d
• 💚 Build #35025 succeeded 5ffe938

cc @tomsonpl