@cdxgen/cdxgen 0.0.1 → 13.0.0

package/data/queries-win.json

@@ -0,0 +1,257 @@
+{
+  "win_version": {
+    "query": "select tb1.name, tb1.build_version, (case when (arch like '%-bit') then concat('x', replace(arch,'-bit', '')) else arch end) as arch, 'Microsoft' as publisher, tb2.version from (select name, version as build_version, arch from os_version) tb1,(select data as version from registry where path = 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion') tb2;",
+    "name": "win_version",
+    "description": "Retrieves the name, version number, build version, and arch of the target Windows system.",
+    "purlType": "swid",
+    "componentType": "operating-system"
+  },
+  "kernel_info": {
+    "query": "select * from kernel_info;",
+    "name": "os-image",
+    "description": "Retrieves information from the current kernel in the target system.",
+    "purlType": "swid"
+  },
+  "chrome_extensions": {
+    "query": "select chrome_extensions.* from users join chrome_extensions using (uid);",
+    "description": "Retrieves the list of extensions for Chrome in the target system.",
+    "purlType": "chrome-extension",
+    "componentType": "application"
+  },
+  "firefox_addons": {
+    "query": "select firefox_addons.* from users join firefox_addons using (uid);",
+    "description": "Retrieves the list of addons for Firefox in the target system.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "vscode_extensions": {
+    "query": "select vscode_extensions.* from users join vscode_extensions using (uid);",
+    "description": "Lists all vscode extensions.",
+    "purlType": "vscode-extension",
+    "componentType": "application"
+  },
+  "browser_plugins": {
+    "query": "select browser_plugins.* from users join browser_plugins using (uid);",
+    "description": "Retrieves the list of C/NPAPI browser plugin in the target system.",
+    "purlType": "swid"
+  },
+  "ie_extensions": {
+    "query": "select * from ie_extensions;",
+    "description": "Retrieves the list of extensions for IE in the target system.",
+    "purlType": "swid"
+  },
+  "opera_extensions": {
+    "query": "select opera_extensions.* from users join opera_extensions using (uid);",
+    "description": "Retrieves the list of extensions for opera in the target system.",
+    "purlType": "swid"
+  },
+  "safari_extensions": {
+    "query": "select safari_extensions.* from users join safari_extensions using (uid);",
+    "description": "Retrieves the list of extensions for safari in the target system.",
+    "purlType": "swid"
+  },
+  "python_packages": {
+    "query": "select * from python_packages;",
+    "description": "Python packages installed on system.",
+    "purlType": "pypi"
+  },
+  "windows_programs": {
+    "query": "select * from programs;",
+    "description": "Retrieves the list of products as they are installed by Windows Installer in the target Windows system.",
+    "purlType": "swid"
+  },
+  "windows_patches": {
+    "query": "select * from patches;",
+    "description": "Retrieves all the information for the current windows drivers in the target Windows system.",
+    "purlType": "swid"
+  },
+  "windows_drivers": {
+    "query": "select * from drivers;",
+    "description": "Retrieves all the information for the current windows drivers in the target Windows system.",
+    "purlType": "swid"
+  },
+  "windows_shared_resources": {
+    "query": "select * from shared_resources;",
+    "description": "Retrieves the list of shared resources in the target Windows system.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "appcompat_shims": {
+    "query": "SELECT * FROM appcompat_shims WHERE description!='EMET_Database' AND executable NOT IN ('setuphost.exe','setupprep.exe','iisexpress.exe');",
+    "description": "Appcompat shims (.sdb files) installed on Windows hosts.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "system_info_snapshot": {
+    "query": "SELECT * FROM system_info;",
+    "description": "System info snapshot query.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "users_snapshot": {
+    "query": "SELECT username as name, uuid as version, description, directory, uid, type, gid FROM users;",
+    "description": "Local and domain-backed user account inventory on Windows endpoints.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "logged_in_users_snapshot": {
+    "query": "SELECT user as name, '' as version, type as description, pid, host, tty, time, sid, registry_hive FROM logged_in_users;",
+    "description": "Interactive and remote user sessions active on the endpoint.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "logon_sessions": {
+    "query": "SELECT user as name, logon_type as version, authentication_package as description, logon_id, logon_domain, session_id, logon_sid, logon_time, logon_server, dns_domain_name, upn, profile_path, home_directory, home_directory_drive FROM logon_sessions;",
+    "description": "Windows logon session inventory for authentication and identity investigations.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "pipes_snapshot": {
+    "query": "SELECT processes.path, processes.cmdline, processes.uid, processes.on_disk, pipes.name, pid FROM pipes JOIN processes USING (pid);",
+    "description": "Pipes snapshot query.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "process_open_handles_snapshot": {
+    "query": "SELECT processes.name, process_open_handles.type as version, process_open_handles.name as description, processes.path, processes.cmdline, processes.pid, process_open_handles.value, process_open_handles.type, process_open_handles.name as handle_name, process_open_handles.access, process_open_handles.attributes, process_open_handles.count, process_open_handles.raw_pointer_count, process_open_handles.error_stage, process_open_handles.error_code FROM processes JOIN process_open_handles USING (pid) WHERE process_open_handles.name != '' AND processes.name IN ('powershell.exe', 'pwsh.exe', 'cmd.exe', 'wscript.exe', 'cscript.exe', 'mshta.exe', 'rundll32.exe', 'regsvr32.exe', 'wmic.exe', 'certutil.exe', 'bitsadmin.exe') AND ((process_open_handles.type = 'File' AND (lower(process_open_handles.name) LIKE '%\\appdata\\local\\temp\\%' OR lower(process_open_handles.name) LIKE '%\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\%' OR lower(process_open_handles.name) LIKE '%\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\%' OR lower(process_open_handles.name) LIKE '%\\windows\\tasks\\%' OR lower(process_open_handles.name) LIKE '%\\system32\\tasks\\%' OR lower(process_open_handles.name) LIKE '%\\wbem\\repository\\%')) OR (process_open_handles.type = 'Key' AND (lower(process_open_handles.name) LIKE '%\\software\\microsoft\\windows\\currentversion\\run%' OR lower(process_open_handles.name) LIKE '%\\software\\microsoft\\windows\\currentversion\\runonce%' OR lower(process_open_handles.name) LIKE '%\\software\\microsoft\\windows nt\\currentversion\\winlogon%' OR lower(process_open_handles.name) LIKE '%\\system\\currentcontrolset\\services\\%' OR lower(process_open_handles.name) LIKE '%\\software\\microsoft\\windows nt\\currentversion\\schedule\\taskcache\\%' OR lower(process_open_handles.name) LIKE '%\\software\\microsoft\\wbem\\cimom%')));",
+    "description": "Open handles owned by high-signal scripting and proxy-execution processes, filtered to persistence-oriented file and registry locations on Windows endpoints.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "services_snapshot": {
+    "query": "SELECT * FROM services;",
+    "description": "Services snapshot query.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "wmi_cli_event_consumers": {
+    "query": "SELECT * FROM wmi_cli_event_consumers;",
+    "description": "WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "wmi_filter_consumer_binding": {
+    "query": "SELECT * FROM wmi_filter_consumer_binding;",
+    "description": "Lists the relationship between event consumers and filters.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "wmi_cli_event_consumers_snapshot": {
+    "query": "SELECT * FROM wmi_cli_event_consumers;",
+    "description": "Snapshot query for WMI event consumers.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "certificates": {
+    "query": "SELECT * FROM certificates WHERE path != 'Other People';",
+    "description": "List all certificates in the trust store.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "wmi_event_filters": {
+    "query": "SELECT * FROM wmi_event_filters;",
+    "description": "Lists WMI event filters.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "windows_security_products": {
+    "query": "SELECT * FROM windows_security_products;",
+    "description": "Registered endpoint security products and signature posture.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "windows_security_center": {
+    "query": "SELECT antivirus as name, firewall as version, autoupdate as description, internet_settings, windows_security_center_service, user_account_control FROM windows_security_center;",
+    "description": "Windows Security Center overall protection health indicators.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "windows_bitlocker_info": {
+    "query": "SELECT device_id as name, drive_letter as version, encryption_method as description, persistent_volume_id, conversion_status, protection_status, percentage_encrypted, lock_status FROM bitlocker_info;",
+    "description": "BitLocker protection and encryption state for local drives.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "windows_run_keys": {
+    "query": "SELECT path as name, mtime as version, data as description, key, type FROM registry WHERE (key LIKE 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\%' OR key LIKE 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\%' OR key LIKE 'HKEY_USERS\\%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\%' OR key LIKE 'HKEY_USERS\\%\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\%') AND type != 'subkey';",
+    "description": "Registry Run/RunOnce autostart entries commonly abused for persistence.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "etc_hosts": {
+    "query": "SELECT * FROM etc_hosts;",
+    "description": "List the contents of the Windows hosts file.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "scheduled_tasks": {
+    "query": "SELECT * FROM scheduled_tasks;",
+    "description": "List all scheduled_tasks.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "chocolatey_packages": {
+    "query": "SELECT * FROM chocolatey_packages;",
+    "description": "List all chocolatey_packages.",
+    "purlType": "chocolatey"
+  },
+  "npm_packages": {
+    "query": "SELECT * FROM npm_packages;",
+    "description": "List all npm_packages.",
+    "purlType": "npm"
+  },
+  "startup_items": {
+    "query": "SELECT * FROM startup_items;",
+    "description": "List all startup_items.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "routes": {
+    "query": "SELECT * FROM routes;",
+    "description": "List all routes.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "listening_ports": {
+    "query": "SELECT DISTINCT process.name, listening.port, listening.protocol, listening.family, listening.address, process.pid, process.path, process.cmdline, process.cwd, process.uid, process.on_disk, process.parent, process.start_time FROM processes AS process JOIN listening_ports AS listening ON process.pid = listening.pid;",
+    "description": "List all processes and their listening_ports.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "processes": {
+    "query": "SELECT * FROM processes;",
+    "description": "List all processes.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "process_open_sockets": {
+    "query": "SELECT * FROM process_open_sockets;",
+    "description": "List all process_open_sockets.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "windows_update_history": {
+    "query": "SELECT * FROM windows_update_history;",
+    "description": "List all windows_update_history.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "windows_optional_features": {
+    "query": "SELECT * FROM windows_optional_features;",
+    "description": "List all windows_optional_features.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "windows_firewall_rules": {
+    "query": "SELECT * FROM windows_firewall_rules;",
+    "description": "List all windows_firewall_rules.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "logical_drives": {
+    "query": "SELECT * FROM logical_drives;",
+    "description": "List all logical_drives.",
+    "purlType": "swid",
+    "componentType": "device"
+  }
+}

package/data/queries.json

@@ -0,0 +1,268 @@
+{
+  "os_version": {
+    "query": "select * from os_version;",
+    "description": "Retrieves the current version of the running osquery in the target system and where the configuration was loaded from.",
+    "purlType": "swid",
+    "componentType": "operating-system"
+  },
+  "kernel_info": {
+    "query": "select * from kernel_info;",
+    "name": "os-image",
+    "description": "Retrieves information from the current kernel in the target system.",
+    "purlType": "swid",
+    "componentType": "operating-system"
+  },
+  "chrome_extensions": {
+    "query": "select chrome_extensions.* from users join chrome_extensions using (uid);",
+    "description": "Retrieves the list of extensions for Chrome in the target system.",
+    "purlType": "chrome-extension",
+    "componentType": "application"
+  },
+  "firefox_addons": {
+    "query": "select firefox_addons.* from users join firefox_addons using (uid);",
+    "description": "Retrieves the list of addons for Firefox in the target system.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "vscode_extensions": {
+    "query": "select vscode_extensions.* from users join vscode_extensions using (uid);",
+    "description": "Lists all vscode extensions.",
+    "purlType": "vscode-extension",
+    "componentType": "application"
+  },
+  "deb_packages": {
+    "query": "select * from deb_packages;",
+    "description": "Retrieves all the installed DEB packages in the target Linux system.",
+    "purlType": "deb"
+  },
+  "apt_sources": {
+    "query": "select * from apt_sources;",
+    "description": "Retrieves all the APT sources to install packages from in the target Linux system.",
+    "purlType": "generic",
+    "componentType": "data"
+  },
+  "apt_ppa_sources": {
+    "query": "SELECT COALESCE(name, base_uri, source) as name, release as version, maintainer as publisher, source as description, source, base_uri, release, components, architectures FROM apt_sources WHERE base_uri LIKE '%ppa.launchpadcontent.net%' OR base_uri LIKE '%ppa.launchpad.net%';",
+    "description": "APT Personal Package Archive (PPA) sources configured on the target Linux system.",
+    "purlType": "generic",
+    "componentType": "data"
+  },
+  "yum_sources": {
+    "query": "select * from yum_sources;",
+    "description": "Display yum package manager sources.",
+    "purlType": "generic",
+    "componentType": "data"
+  },
+  "trusted_gpg_keys": {
+    "query": "SELECT COALESCE(file.filename, file.path) as name, hash.sha256 as version, file.path as description, file.path, file.directory, file.filename, file.uid, file.gid, file.mode, file.size, file.mtime, hash.sha1, hash.sha256, CASE WHEN file.path LIKE '/etc/apt/%' OR file.path LIKE '/usr/share/keyrings/%' THEN 'apt' WHEN file.path LIKE '/etc/pki/rpm-gpg/%' OR file.path LIKE '/usr/share/distribution-gpg-keys/%' THEN 'rpm' WHEN file.path LIKE '/etc/apk/keys/%' THEN 'apk' ELSE 'generic' END AS trust_domain FROM file JOIN hash USING (path) WHERE (file.path = '/etc/apt/trusted.gpg' OR file.path LIKE '/etc/apt/trusted.gpg.d/%' OR file.path LIKE '/usr/share/keyrings/%' OR file.path LIKE '/etc/pki/rpm-gpg/%' OR file.path LIKE '/usr/share/distribution-gpg-keys/%' OR file.path LIKE '/etc/apk/keys/%') AND file.type = 'regular';",
+    "description": "Trusted repository keyring material for APT, RPM/DNF, and APK package trust validation.",
+    "purlType": "generic",
+    "componentType": "cryptographic-asset"
+  },
+  "portage_packages": {
+    "query": "select * from portage_packages;",
+    "description": "Retrieves all the installed packages on the target Linux system.",
+    "purlType": "ebuild"
+  },
+  "rpm_packages": {
+    "query": "select * from rpm_packages;",
+    "description": "Retrieves all the installed RPM packages in the target Linux system.",
+    "purlType": "rpm"
+  },
+  "python_packages": {
+    "query": "select * from python_packages;",
+    "description": "Python packages installed on system.",
+    "purlType": "pypi"
+  },
+  "npm_packages": {
+    "query": "SELECT * FROM npm_packages;",
+    "description": "Node packages installed on the system, including recursively discovered modern package manager layouts.",
+    "purlType": "npm"
+  },
+  "system_info_snapshot": {
+    "query": "SELECT * FROM system_info;",
+    "description": "System info snapshot query.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "users_snapshot": {
+    "query": "SELECT username as name, uuid as version, description, directory, shell, uid, gid FROM users;",
+    "description": "Local user inventory for account and shell posture analysis.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "logged_in_users_snapshot": {
+    "query": "SELECT user as name, '' as version, type as description, pid, tty, host, time FROM logged_in_users;",
+    "description": "Interactive and remote user sessions currently active on the host.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "shell_history_snapshot": {
+    "query": "SELECT users.username as name, '' as version, shell_history.command as description, shell_history.time, shell_history.history_file, shell_history.uid FROM users JOIN shell_history USING (uid);",
+    "description": "User shell command history metadata for investigation support.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "authorized_keys_snapshot": {
+    "query": "SELECT users.username as name, authorized_keys.algorithm as version, authorized_keys.comment as description, authorized_keys.key_file, authorized_keys.options, authorized_keys.uid FROM users JOIN authorized_keys USING (uid);",
+    "description": "Authorized SSH key metadata per account without exporting key material.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "sudoers_snapshot": {
+    "query": "SELECT header as name, source as path, rule_details as description FROM sudoers;",
+    "description": "Sudo policy entries for least-privilege and privileged access review.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "etc_hosts": {
+    "query": "SELECT * FROM etc_hosts;",
+    "description": "List the contents of the Windows hosts file.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "crontab_snapshot": {
+    "query": "SELECT * FROM crontab;",
+    "description": "Retrieves all the jobs scheduled in crontab in the target system.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "sysctl_hardening": {
+    "query": "SELECT name, current_value as version, name as sysctl_key, current_value FROM sysctl WHERE name IN ('kernel.randomize_va_space', 'kernel.kptr_restrict', 'net.ipv4.conf.all.accept_redirects', 'net.ipv4.conf.default.accept_redirects', 'net.ipv4.conf.all.send_redirects', 'net.ipv4.conf.default.send_redirects');",
+    "description": "Linux sysctl posture entries aligned with common hardening baselines.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "kernel_modules": {
+    "query": "SELECT * FROM kernel_modules;",
+    "description": "Linux kernel modules both loaded and within the load search path.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "secureboot_certificates": {
+    "query": "SELECT COALESCE(common_name, subject, sha1) as name, COALESCE(subject_key_id, sha1) as version, issuer as publisher, subject as description, common_name, subject, issuer, serial, sha1, revoked, path, is_ca, self_signed, key_usage, authority_key_id, subject_key_id, signing_algorithm, key_algorithm, key_strength, not_valid_before, not_valid_after FROM secureboot_certificates;",
+    "description": "UEFI Secure Boot certificate inventory, including trusted and revoked entries, for firmware trust posture reviews.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "mount_hardening": {
+    "query": "SELECT path as name, flags as version, device as description, path, device, type, flags FROM mounts WHERE path IN ('/tmp', '/var/tmp', '/dev/shm', '/home');",
+    "description": "Linux mount points commonly reviewed for noexec, nodev, and nosuid hardening.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "systemd_units": {
+    "query": "SELECT id as name, active_state as version, description, load_state, sub_state, unit_file_state, user, fragment_path, source_path FROM systemd_units;",
+    "description": "Systemd unit state and execution source inventory.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "etc_services": {
+    "query": "SELECT * FROM etc_services;",
+    "description": "Service-to-port mappings configured in /etc/services.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "behavioral_reverse_shell": {
+    "query": "SELECT DISTINCT(processes.pid), processes.parent, processes.name, processes.path, processes.cmdline, processes.cwd, processes.root, processes.uid, processes.gid, processes.start_time, process_open_sockets.remote_address, process_open_sockets.remote_port, (SELECT cmdline FROM processes AS parent_cmdline WHERE pid=processes.parent) AS parent_cmdline FROM processes JOIN process_open_sockets USING (pid) LEFT OUTER JOIN process_open_files ON processes.pid = process_open_files.pid WHERE (name='sh' OR name='bash') AND remote_address NOT IN ('0.0.0.0', '::', '') AND remote_address NOT LIKE '10.%' AND remote_address NOT LIKE '192.168.%';",
+    "description": "Find shell processes that have open sockets.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "process_events": {
+    "query": "SELECT auid, cmdline, ctime, cwd, egid, euid, gid, parent, path, pid, time, uid FROM process_events WHERE path NOT IN ('/bin/sed', '/usr/bin/tr', '/bin/gawk', '/bin/date', '/bin/mktemp', '/usr/bin/dirname', '/usr/bin/head', '/usr/bin/jq', '/bin/cut', '/bin/uname', '/bin/basename') and cmdline NOT LIKE '%_key%' AND cmdline NOT LIKE '%secret%';",
+    "description": "Process events collected from the audit framework.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "sudo_executions": {
+    "query": "SELECT COALESCE((SELECT proc.name FROM processes AS proc WHERE proc.pid = process_events.pid), process_events.path) AS name, process_events.path, process_events.cmdline, process_events.cwd, process_events.auid, process_events.uid, process_events.euid, process_events.gid, process_events.egid, process_events.parent, process_events.pid, process_events.time, process_events.ctime, COALESCE((SELECT username FROM users WHERE uid = process_events.auid), '') AS login_user, COALESCE((SELECT username FROM users WHERE uid = process_events.uid), '') AS real_user, COALESCE((SELECT username FROM users WHERE uid = process_events.euid), '') AS effective_user, COALESCE((SELECT parent.name FROM processes AS parent WHERE parent.pid = process_events.parent), '') AS parent_name, COALESCE((SELECT parent.path FROM processes AS parent WHERE parent.pid = process_events.parent), '') AS parent_path, COALESCE((SELECT parent.cmdline FROM processes AS parent WHERE parent.pid = process_events.parent), '') AS parent_cmdline, COALESCE((SELECT unit.id FROM systemd_units AS unit WHERE unit.fragment_path = process_events.path OR unit.source_path = process_events.path LIMIT 1), '') AS service_unit, CASE WHEN process_events.path LIKE '/usr/bin/%' OR process_events.path LIKE '/usr/sbin/%' OR process_events.path LIKE '/bin/%' OR process_events.path LIKE '/sbin/%' THEN 'system-package-path' WHEN process_events.path LIKE '/opt/%' THEN 'optional-system-path' WHEN process_events.path LIKE '/snap/%' THEN 'snap-path' WHEN process_events.path LIKE '/home/%' OR process_events.path LIKE '/tmp/%' OR process_events.path LIKE '/var/tmp/%' OR process_events.path LIKE '/dev/shm/%' OR process_events.path LIKE '/run/user/%' THEN 'user-writable-path' ELSE 'unclassified-path' END AS package_source_hint FROM process_events WHERE (process_events.path IN ('/usr/bin/sudo', '/usr/bin/pkexec', '/usr/bin/doas', '/bin/su', '/usr/bin/su') OR process_events.cmdline LIKE 'sudo %' OR process_events.cmdline LIKE 'pkexec %' OR process_events.cmdline LIKE '% pkexec %' OR process_events.cmdline LIKE 'doas %' OR process_events.cmdline LIKE '% doas %' OR process_events.cmdline LIKE 'su %') AND process_events.cmdline NOT LIKE '%_key%' AND process_events.cmdline NOT LIKE '%secret%';",
+    "description": "Privileged execution events involving sudo, pkexec, doas, or su.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "privilege_transitions": {
+    "query": "SELECT COALESCE((SELECT proc.name FROM processes AS proc WHERE proc.pid = process_events.pid), process_events.path) AS name, process_events.path, process_events.cmdline, process_events.cwd, process_events.auid, process_events.uid, process_events.euid, process_events.gid, process_events.egid, process_events.parent, process_events.pid, process_events.time, process_events.ctime, COALESCE((SELECT username FROM users WHERE uid = process_events.auid), '') AS login_user, COALESCE((SELECT username FROM users WHERE uid = process_events.uid), '') AS real_user, COALESCE((SELECT username FROM users WHERE uid = process_events.euid), '') AS effective_user, COALESCE((SELECT parent.name FROM processes AS parent WHERE parent.pid = process_events.parent), '') AS parent_name, COALESCE((SELECT parent.path FROM processes AS parent WHERE parent.pid = process_events.parent), '') AS parent_path, COALESCE((SELECT parent.cmdline FROM processes AS parent WHERE parent.pid = process_events.parent), '') AS parent_cmdline, COALESCE((SELECT unit.id FROM systemd_units AS unit WHERE unit.fragment_path = process_events.path OR unit.source_path = process_events.path LIMIT 1), '') AS service_unit, CASE WHEN process_events.path LIKE '/usr/bin/%' OR process_events.path LIKE '/usr/sbin/%' OR process_events.path LIKE '/bin/%' OR process_events.path LIKE '/sbin/%' THEN 'system-package-path' WHEN process_events.path LIKE '/opt/%' THEN 'optional-system-path' WHEN process_events.path LIKE '/snap/%' THEN 'snap-path' WHEN process_events.path LIKE '/home/%' OR process_events.path LIKE '/tmp/%' OR process_events.path LIKE '/var/tmp/%' OR process_events.path LIKE '/dev/shm/%' OR process_events.path LIKE '/run/user/%' THEN 'user-writable-path' ELSE 'unclassified-path' END AS package_source_hint FROM process_events WHERE (process_events.uid != process_events.euid OR process_events.gid != process_events.egid) AND process_events.path NOT IN ('/bin/sed', '/usr/bin/tr', '/bin/gawk', '/bin/date', '/bin/mktemp', '/usr/bin/dirname', '/usr/bin/head', '/usr/bin/jq', '/bin/cut', '/bin/uname', '/bin/basename') AND process_events.cmdline NOT LIKE '%_key%' AND process_events.cmdline NOT LIKE '%secret%';",
+    "description": "Process executions where real and effective privileges differ.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "elevated_processes": {
+    "query": "SELECT DISTINCT process.name, process.path, process.cmdline, process.cwd, process.root, process.uid, process.gid, process.pid, process.parent, process.start_time, process.on_disk, COALESCE(users.username, '') AS account, COALESCE((SELECT parent.name FROM processes AS parent WHERE parent.pid = process.parent), '') AS parent_name, COALESCE((SELECT parent.path FROM processes AS parent WHERE parent.pid = process.parent), '') AS parent_path, COALESCE((SELECT parent.cmdline FROM processes AS parent WHERE parent.pid = process.parent), '') AS parent_cmdline, COALESCE((SELECT unit.id FROM systemd_units AS unit WHERE unit.fragment_path = process.path OR unit.source_path = process.path LIMIT 1), '') AS service_unit, CASE WHEN process.path LIKE '/usr/bin/%' OR process.path LIKE '/usr/sbin/%' OR process.path LIKE '/bin/%' OR process.path LIKE '/sbin/%' THEN 'system-package-path' WHEN process.path LIKE '/opt/%' THEN 'optional-system-path' WHEN process.path LIKE '/snap/%' THEN 'snap-path' WHEN process.path LIKE '/home/%' OR process.path LIKE '/tmp/%' OR process.path LIKE '/var/tmp/%' OR process.path LIKE '/dev/shm/%' OR process.path LIKE '/run/user/%' THEN 'user-writable-path' ELSE 'unclassified-path' END AS package_source_hint FROM processes AS process LEFT JOIN users ON process.uid = users.uid WHERE process.uid = 0 OR process.uid BETWEEN 1 AND 999;",
+    "description": "Processes running as root or service-style system accounts with lineage hints.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "ld_preload": {
+    "query": "SELECT process_envs.pid, process_envs.key, process_envs.value, processes.name, processes.path, processes.cmdline, processes.cwd FROM process_envs join processes USING (pid) WHERE key = 'LD_PRELOAD';",
+    "description": "Any processes that run with an LD_PRELOAD environment variable.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "certificates": {
+    "query": "SELECT * FROM certificates WHERE path != 'Other People';",
+    "description": "List all certificates in the trust store.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "processes": {
+    "query": "SELECT * FROM processes;",
+    "description": "List all processes.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "process_open_sockets": {
+    "query": "SELECT * FROM process_open_sockets WHERE remote_address NOT IN ('0.0.0.0', '::', '');",
+    "description": "Network sockets opened by processes with non-empty remote endpoints.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "startup_items": {
+    "query": "SELECT * FROM startup_items;",
+    "description": "List all startup_items.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "listening_ports": {
+    "query": "SELECT DISTINCT process.name, listening.port, listening.protocol, listening.family, listening.address, process.pid, process.path, process.cmdline, process.cwd, process.uid, process.on_disk, process.parent, process.start_time FROM processes AS process JOIN listening_ports AS listening ON process.pid = listening.pid;",
+    "description": "List all processes and their listening_ports.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "privileged_listening_ports": {
+    "query": "SELECT DISTINCT process.name, listening.port, listening.protocol, listening.family, listening.address, process.pid, process.path, process.cmdline, process.cwd, process.uid, process.gid, process.on_disk, process.parent, process.start_time, COALESCE(users.username, '') AS account, COALESCE((SELECT parent.name FROM processes AS parent WHERE parent.pid = process.parent), '') AS parent_name, COALESCE((SELECT parent.path FROM processes AS parent WHERE parent.pid = process.parent), '') AS parent_path, COALESCE((SELECT parent.cmdline FROM processes AS parent WHERE parent.pid = process.parent), '') AS parent_cmdline, COALESCE((SELECT unit.id FROM systemd_units AS unit WHERE unit.fragment_path = process.path OR unit.source_path = process.path LIMIT 1), '') AS service_unit, CASE WHEN process.path LIKE '/usr/bin/%' OR process.path LIKE '/usr/sbin/%' OR process.path LIKE '/bin/%' OR process.path LIKE '/sbin/%' THEN 'system-package-path' WHEN process.path LIKE '/opt/%' THEN 'optional-system-path' WHEN process.path LIKE '/snap/%' THEN 'snap-path' WHEN process.path LIKE '/home/%' OR process.path LIKE '/tmp/%' OR process.path LIKE '/var/tmp/%' OR process.path LIKE '/dev/shm/%' OR process.path LIKE '/run/user/%' THEN 'user-writable-path' ELSE 'unclassified-path' END AS package_source_hint FROM processes AS process JOIN listening_ports AS listening ON process.pid = listening.pid LEFT JOIN users ON process.uid = users.uid WHERE process.uid = 0 OR process.uid BETWEEN 1 AND 999;",
+    "description": "Listening ports owned by root or service-style processes with lineage and path hints.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "interface_addresses": {
+    "query": "SELECT * FROM interface_addresses;",
+    "description": "List all interface_addresses.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "docker_container_ports": {
+    "query": "SELECT * FROM docker_container_ports;",
+    "description": "List all docker_container_ports.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "docker_containers": {
+    "query": "SELECT * FROM docker_containers;",
+    "description": "List all docker_containers.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "docker_networks": {
+    "query": "SELECT * FROM docker_networks;",
+    "description": "List all docker_networks.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "docker_volumes": {
+    "query": "SELECT * FROM docker_volumes;",
+    "description": "List all docker_volumes.",
+    "purlType": "swid",
+    "componentType": "data"
+  }
+}