Elastic Demonstrates Osquery-Based DFIR From Alert to Root Cause
Summary
Elastic demonstrates using Osquery and Elastic Security to reconstruct an illustrative phishing-to-Mimikatz execution from endpoint artifacts without a disk image, then reuse forensic queries as scheduled detections.
Key points
- The article presents distributed, query-driven forensics as an alternative to collecting full disk images across dynamic endpoint fleets.
- Elastic describes integrating Osquery with Elastic Security, storing results for search, and providing forensic queries and packs.
- An illustrative scenario traces a phishing download of discount.zip to Mimikatz using browser history, file checks, Shellbags, Shimcache, UserAssist, and Prefetch.
- The article says the artifacts indicate a 26-minute interval between folder navigation and Mimikatz execution; this is presented as a human-in-the-loop scenario, not a report of a confirmed real-world incident.
- Scheduled Osquery packs can supply indexed endpoint data for SIEM detection rules and fleet-wide hunts.
- The described response options include isolating an affected host and collecting a memory dump for further analysis.
Article Details
- Defense Focus
- Use distributed Osquery queries and endpoint telemetry to reconstruct phishing-related execution, turn forensic queries into ongoing detections, and respond before activity can spread.
- Detection Methods
- Query browser history to identify access to the phishing download link.
- Check the endpoint file table for the downloaded archive and assess its hash reputation; the article does not provide the hash.
- Correlate Shellbags, Shimcache, UserAssist, and Prefetch artifacts to determine folder navigation and whether the binary was executed.
- Run curated or scheduled Osquery packs across endpoints to hunt for similar execution patterns and potential lateral movement.
- Use scheduled Osquery results as a data source for SIEM detection rules.
- Data Sources
- Browser history
- Endpoint file and hash-reputation results
- Shellbags
- Shimcache
- UserAssist
- Prefetch
- Registry entries
- Scheduled tasks
- Osquery results indexed under logs-osquery_manager.result*
- Elastic Defend alerts and endpoint telemetry
- Rule Types
- SQL queries against Osquery tables
- Scheduled Osquery packs
- SIEM detection rules using indexed Osquery results
- Defensive Actions
- Isolate the affected host after confirming malicious execution to prevent further communication and reduce lateral-movement risk.
- Collect a memory dump when deeper analysis of in-memory activity is needed.
- Reuse validated forensic queries as scheduled fleet-wide hunts and detections.
- Correlate endpoint artifacts to establish the activity timeline and identify other affected systems.
MITRE ATT&CK
Malware
Vendors
Products
Elastic DefendElastic integrates Osquery with Elastic Defend and Elastic Security to eliminate tool-switching, store results in Elasticsearch mapped to ECS, and provide curated forensic queries and packs.Elastic Securityquery-driven investigations that interrogate endpoints in real time using tools like Osquery and Elastic Security to get answers before attackers move laterally.ElasticsearchElastic integrates Osquery with Elastic Defend and Elastic Security to eliminate tool-switching, store results in Elasticsearch mapped to ECS, and provide curated forensic queries and packs.
Tools
Osqueryto distributed, query-driven investigations that interrogate endpoints in real time using tools like Osquery and Elastic Security to get answers before attackers move laterally.volatilityThis memory dump can be downloaded and analyzed using external tools, such as Volatility, enabling further investigation of in-memory activity that may not be visible through traditional artifacts.