Retrieves all the open sockets per process in the target system.


Query · osquery

-- Retrieves all the open sockets per process in the target system.
--
-- tags: postmortem
-- platform: posix
SELECT DISTINCT
  pid,
  family,
  protocol,
  local_address,
  local_port,
  remote_address,
  remote_port,
  path
FROM
  process_open_sockets
WHERE
  path <> ''
  or remote_address <> '';
Raw source Retrieves all the open sockets per process in the target system. · osquery SQL
Esc
Published by chainguard-dev/osquery-defense-kit ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified.
-- Retrieves all the open sockets per process in the target system.
--
-- tags: postmortem
-- platform: posix
SELECT DISTINCT
  pid,
  family,
  protocol,
  local_address,
  local_port,
  remote_address,
  remote_port,
  path
FROM
  process_open_sockets
WHERE
  path <> ''
  or remote_address <> '';

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.