Osquery: Using D-Bus to query systemd data
Summary: A Trail of Bits summer intern ported osquery's startup_items table to Linux and added systemd support through the D-Bus API, since systemd unit files could not be parsed directly like other startup item locations. The work also produced a new systemd_units table with a column for unit types such as service, socket, and device, and the community agreed on the unit-based table direction after a conversation that had stalled a few years earlier.
Key Takeaway: Startup items and systemd units are where persistence lives on Linux, and osquery's existing startup_items table covered only macOS and Windows until this work; defenders monitoring Linux endpoints now have a way to enumerate those locations through SQL queries.
Read the original at Trail of Bits Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026