[GH-ISSUE #12] New module - osquery (windows) #6

New Issue

2026-06-06T22:10:33-04:00

yindo commented

2026-06-06 22:10:33 -04:00

Originally created by @Arkweid on GitHub (Dec 8, 2022).
Original GitHub issue: https://github.com/vxcontrol/soldr-modules/issues/12

Originally assigned to: @0legovich on GitHub.

Osquery is very useful project for threat-hunting process. Write a module which one could install Osquery on the target system.

Definition of Done:

Installation of the osquery package with preinstalled configuration files on Windows OS;
Ability to create and manage the osquery process;
updating the osquery package;
updating of the main osquery configuration files;

An example of a similar module: "sysmon".

At the moment we are planning to interact with the installed osquery in the following way:

Interactively through the regular osqueryi component (using the XDR "shell" module);
Collecting events from the osquery log and redirecting them to the common event repository (using the XDR module "data collection from textual event logs").

An example of the application usefulness of osquery in TH: https://medium.com/@gabriel.pirjolescu/demystifying-windows-malware-hunting-part-1-detecting-persistence-with-osquery-b53573c2aac0

Originally created by @Arkweid on GitHub (Dec 8, 2022). Original GitHub issue: https://github.com/vxcontrol/soldr-modules/issues/12 Originally assigned to: @0legovich on GitHub. **Osquery** is very useful project for threat-hunting process. Write a module which one could install **Osquery** on the target system. **Definition of Done**: 1. Installation of the osquery package with preinstalled configuration files on Windows OS; 2. Ability to create and manage the osquery process; 3. updating the osquery package; 4. updating of the main osquery configuration files; An example of a similar module: "sysmon". At the moment we are planning to interact with the installed osquery in the following way: 1. Interactively through the regular osqueryi component (using the XDR "shell" module); 2. Collecting events from the osquery log and redirecting them to the common event repository (using the XDR module "data collection from textual event logs"). An example of the application usefulness of osquery in TH: https://medium.com/@gabriel.pirjolescu/demystifying-windows-malware-hunting-part-1-detecting-persistence-with-osquery-b53573c2aac0

yindo added the enhancement windows osquery labels 2026-06-06 22:10:33 -04:00

yindo closed this issue

2026-06-06 22:10:34 -04:00

yindo referenced this issue

2026-06-06 22:10:41 -04:00

[PR #6] [MERGED] fix: yara validation #21

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: vxcontrol/soldr-modules#6