Lion Cipher Lab
Hunt on your own endpoint with osquery
- SOC Analyst / Blue Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Visibility is only worth something when you use it to ask a hard question. The configure lab gave you the tables and a baseline; hunting is the act of interrogating them — not scrolling a full process list, but asking a specific question that would only be true if something were wrong, and reading the answer. The skills here are exactly what a SOC analyst or threat hunter does at scale: join a listening port to the process behind it to catch an unexpected open door, walk crontab and startup_items to find how an intruder arranged to survive a reboot, list the files a suspicious process is…
What you'll learn
- threat hunting on an endpoint
- querying the OS as SQL tables
- writing SQL JOINs across osquery tables
- filtering results with WHERE
- mapping a listening port to the process that owns it
- hunting persistence in crontab and startup_items
- reading process_open_files
- fingerprinting a binary with the hash table
- saving queries as an osquery pack
- understanding osquery's snapshot and read-only limits
Steps in this lab
- What hunting means here, and where you type it
- What is listening, and who owns it? (your first JOIN)
- Who can log in, and who is logged in right now?
- How would it survive a reboot? Hunt persistence
- What is a process touching? process_open_files
- Fingerprint the binary: the hash table
- Make it repeatable: save your queries as a pack
- Know the edges: snapshot, read-only, and "a query is a lead"