Good news, the social network giant Facebook finally announced the availability of the open source OSquery developer kit for Windows.
Facebook announced to have completed the porting of its detection open-source tool OSquery to Windows. The tool allows users to monitor networks and to detect potential malicious activities, such as the presence of malicious codes.
The cross-platform tool, that is available on GitHub, was first released in 2014, but it was only supported on Ubuntu, CentOS, and Mac OS X operating systems.
“Today, we’re excited to announce the availability of an OSquery developer kit for Windows! Security teams can now build customized osquery solutions for their Windows networks.” reads the Facebook’s announcement.
OSquery is a component that is able to scan every machine on an infrastructure collecting a huge amount of information on their operations in real-time. Data gathered by the tool allows to quickly search for malicious behavior and eradicate the threat, for this reason, this technique is defined “threat hunting.”
“With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events or file hashes. Having timely, reliable visibility into operations running throughout your network is critical to quickly identify and investigate anomalies.” continues the announcement.
“For example, osquery allows our Facebook security team to fetch data about all browser extensions running on our corporate network. We then compare that information to threat intelligence data to quickly identify malicious extensions and remove them. This proactive technique, known as “threat hunting,” is an important enhancement to traditional detection-based security, but not yet offered by many commercial agents.”
Experts at Facebook suggest administrators that want to run the developer kit for Windows to check the official documentation, the tool is easy to install and use.
“The osquery developer kit for Windows includes documentation, the development environment, and a single script to get you started. Once you install the build, you can start coding right away.”
The full documentation of the development process of the developer kit for Windows is available on the blog post by Trail of Bits.
Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer.
Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US.
Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines.
Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.