osquery hunting

osqueryi "SELECT * FROM processes WHERE name LIKE '%mimikatz%'"

Live SQL query on system state with osqueryi: processes, connections, files, with the flexibility of a SELECT.

Run it when you need to answer specific questions about a host without installing anything: osqueryi gives you a SQL console over the system — processes (name, cmdline, path), network connections, files, scheduled tasks, services. The example query looks for processes whose name contains mimikatz (or any tool), and the same logic works for connections to suspicious IPs, recent files in Temp, or new services. In a SOC without EDR agents, osquery is the visibility layer that remains; in managed fleets (Fleet, Kolide), the same query runs on all hosts at once. It's the modern equivalent of sysinternals queries, but with SQL.

Don't use it for what it's not: osqueryi is a point-in-time snapshot — processes that already died or connections that already closed won't show up; for continuous detection, use Fleet's scheduled queries or the EDR. The processes table depends on the system: on Windows, cmdline may require privileges; on macOS, some tables need the EndpointSecurity extension. And watch out for performance: queries without filters on large tables (file, process_open_files) on busy hosts take time; use minimal fields and filter in the query.