vulnerability_dep
SCHEMA
| analysis | string | JSON object representing the analysis |
| data | string | Data content of registry value |
| key | string | Name of the key |
| mtime | long | time of the most recent registry write |
| name | string | Name of the registry value entry |
| path | string | Full path to the value |
| type | string | Type of the registry value |
-- vulnerability_dep INFO SELECT -- Device ID DETAILS meta_hostname, meta_ip_address, -- Query Details query_name, analysis, data, key, mtime, name, path, type, -- Decoration meta_boot_time, meta_eid, meta_endpoint_type, meta_ip_mask, meta_mac_address, meta_os_name, meta_os_platform, meta_os_type, meta_os_version, meta_public_ip, meta_query_pack_version, meta_username, --- Generic calendar_time, counter, epoch, host_identifier, numerics osquery_action, unix_time, -- Data Lake customer_id, endpoint_id, upload_size FROM xdr_data WHERE query_name = 'vulnerability_dep'
Ohh Fun, it found stuff in my environment. Now what to do...
Lets read more on DEP.
RESULTS
+-----------------+-------------------+-------------------+---------------------------------------------------+------------------------+-----------------------------------------------------+------------+--------------------+------------------------------------------------------------------------+--------+------------------+--------------------------------------+----------------------+----------------+--------------------+------------------------------+--------------------+----------------+-------------------+------------------+---------------------------+-----------------+----------------------+-----------+------------+-------------------+------------------+----------------------+--------------------------------------+--------------------------------------+---------------+
| meta_hostname | meta_ip_address | query_name | analysis | data | key | mtime | name | path | type | meta_boot_time | meta_eid | meta_endpoint_type | meta_ip_mask | meta_mac_address | meta_os_name | meta_os_platform | meta_os_type | meta_os_version | meta_public_ip | meta_query_pack_version | meta_username | calendar_time | counter | epoch | host_identifier | osquery_action | unix_time | customer_id | endpoint_id | upload_size |
|-----------------+-------------------+-------------------+---------------------------------------------------+------------------------+-----------------------------------------------------+------------+--------------------+------------------------------------------------------------------------+--------+------------------+--------------------------------------+----------------------+----------------+--------------------+------------------------------+--------------------+----------------+-------------------+------------------+---------------------------+-----------------+----------------------+-----------+------------+-------------------+------------------+----------------------+--------------------------------------+--------------------------------------+---------------|
| DESKTOP-RB61UC8 | 192.168.1.173 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN NOVGA | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601472795 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601472788 | eface84e-4db6-344f-a89d-90801856834f | computer | 255.255.255.0 | 5c:ea:1d:c1:aa:55 | Microsoft Windows 10 Pro | windows | client | 10.0.19041 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-09T13:36:34Z | 0 | 1601772041 | DESKTOP-RB61UC8 | False | 2020-10-09T13:36:34Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | feca8ee4-d46b-43f4-8ad9-0908816538f4 | 952 |
| Victim3-EDR | 192.168.100.143 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601905067 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601905066 | 07343bcf-3fb4-34bb-58a0-75ea91b4d569 | computer | 255.255.255.0 | 00:50:56:2a:3a:13 | Microsoft Windows 7 Ultimate | windows | client | 6.1.7601 | 73.69.54.187 | 1.1.12 | test | 2020-10-13T08:03:48Z | 0 | 1602320453 | Victim3-EDR | False | 2020-10-13T08:03:48Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | 7043b3fc-f34b-43bb-850a-57ae194b5d96 | 941 |
| Victim1-EDR | 192.168.100.164 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601905070 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601905070 | 3d5d8411-6066-04f4-4872-ec787ed9b973 | computer | 255.255.255.0 | 00:50:56:25:94:3c | Microsoft Windows 7 Ultimate | windows | client | 6.1.7601 | 73.69.54.187 | 1.1.12 | test | 2020-10-13T08:54:09Z | 0 | 1602319950 | Victim1-EDR | False | 2020-10-13T08:54:09Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | d3d54811-0666-404f-8427-ce87e79d9b37 | 941 |
| Victim4-Win10 | 192.168.100.162 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601910648 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601910644 | 2fd10d5e-3267-4476-aa1c-182846a3eac0 | computer | 255.255.255.0 | 00:50:56:3c:c7:00 | Microsoft Windows 10 Pro | windows | client | 10.0.18363 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-13T10:01:04Z | 0 | 1602321709 | Victim4-Win10 | False | 2020-10-13T10:01:04Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | f21dd0e5-2376-4467-aac1-8182643aae0c | 943 |
| DESKTOP-RB61UC8 | 192.168.1.173 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN NOVGA | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601472795 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601472787 | eface84e-4db6-344f-a89d-90801856834f | computer | 255.255.255.0 | 5c:ea:1d:c1:aa:55 | Microsoft Windows 10 Pro | windows | client | 10.0.19041 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-10T00:24:02Z | 0 | 1602286841 | DESKTOP-RB61UC8 | False | 2020-10-10T00:24:02Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | feca8ee4-d46b-43f4-8ad9-0908816538f4 | 952 |
| Victim3-EDR | 192.168.100.143 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601905067 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601905066 | 07343bcf-3fb4-34bb-58a0-75ea91b4d569 | computer | 255.255.255.0 | 00:50:56:2a:3a:13 | Microsoft Windows 7 Ultimate | windows | client | 6.1.7601 | 73.69.54.187 | 1.1.12 | test | 2020-10-10T10:18:00Z | 0 | 1602320453 | Victim3-EDR | False | 2020-10-10T10:18:00Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | 7043b3fc-f34b-43bb-850a-57ae194b5d96 | 941 |
| Victim1-EDR | 192.168.100.164 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601905070 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601905070 | 3d5d8411-6066-04f4-4872-ec787ed9b973 | computer | 255.255.255.0 | 00:50:56:25:94:3c | Microsoft Windows 7 Ultimate | windows | client | 6.1.7601 | 73.69.54.187 | 1.1.12 | test | 2020-10-10T10:41:09Z | 0 | 1602319950 | Victim1-EDR | False | 2020-10-10T10:41:09Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | d3d54811-0666-404f-8427-ce87e79d9b37 | 941 |
| Victim4-Win10 | 192.168.100.162 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1602670572 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1602670574 | 2fd10d5e-3267-4476-aa1c-182846a3eac0 | computer | 255.255.255.0 | 00:50:56:3c:c7:00 | Microsoft Windows 10 Pro | windows | client | 10.0.18363 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-14T11:08:52Z | 0 | 1602321709 | Victim4-Win10 | False | 2020-10-14T11:08:52Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | f21dd0e5-2376-4467-aac1-8182643aae0c | 943 |
| Victim5-Win10 | 192.168.100.129 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1602637660 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1602637660 | 099242c2-3595-94e0-891c-51a7ee2659c8 | computer | 255.255.255.0 | 00:0c:29:56:e8:01 | Microsoft Windows 10 Pro | windows | client | 10.0.18363 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-14T02:09:31Z | 14 | 1602413479 | Victim5-Win10 | False | 2020-10-14T02:09:31Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | 9029242c-5359-490e-98c1-157aee62958c | 944 |
| Victim4-Win10 | 192.168.100.162 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1602642271 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1602642271 | 2fd10d5e-3267-4476-aa1c-182846a3eac0 | computer | 255.255.255.0 | 00:50:56:3c:c7:00 | Microsoft Windows 10 Pro | windows | client | 10.0.18363 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-14T03:02:17Z | 16 | 1602321709 | Victim4-Win10 | False | 2020-10-14T03:02:17Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | f21dd0e5-2376-4467-aac1-8182643aae0c | 944 |
| Victim5-Win10 | 192.168.100.129 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601910608 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601910607 | 099242c2-3595-94e0-891c-51a7ee2659c8 | computer | 255.255.255.0 | 00:0c:29:56:e8:01 | Microsoft Windows 10 Pro | windows | client | 10.0.18363 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-11T11:10:51Z | 0 | 1602413479 | Victim5-Win10 | False | 2020-10-11T11:10:51Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | 9029242c-5359-490e-98c1-157aee62958c | 943 |
| Victim5-Win10 | 192.168.100.129 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601910608 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601910607 | 099242c2-3595-94e0-891c-51a7ee2659c8 | computer | 255.255.255.0 | 00:0c:29:56:e8:01 | Microsoft Windows 10 Pro | windows | client | 10.0.18363 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-13T09:19:29Z | 0 | 1602413479 | Victim5-Win10 | False | 2020-10-13T09:19:29Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | 9029242c-5359-490e-98c1-157aee62958c | 943 |
| Victim4-Win10 | 192.168.100.162 | vulnerability_dep | {"dep_opt_out":0,"dep_alwayson":0,"dep_opt_in":1} | NOEXECUTE=OPTIN | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control | 1601910648 | SystemStartOptions | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SystemStartOptions | REG_SZ | 1601910645 | 2fd10d5e-3267-4476-aa1c-182846a3eac0 | computer | 255.255.255.0 | 00:50:56:3c:c7:00 | Microsoft Windows 10 Pro | windows | client | 10.0.18363 | 73.69.54.187 | 1.1.12 | Admin | 2020-10-10T10:22:12Z | 0 | 1602321709 | Victim4-Win10 | False | 2020-10-10T10:22:12Z | b288d41b-53bb-64ae-5a67-1bc1507d5198 | f21dd0e5-2376-4467-aac1-8182643aae0c | 943 |
+-----------------+-------------------+-------------------+---------------------------------------------------+---