Osquery

v5.12.1Linux Foundation (originally Facebook)

Exposes processes, users, sockets, kernel modules, launchd/systemd units and more as SQL tables. Threat hunters write `SELECT ... FROM processes WHERE ...` queries. The range's osqueryi answers from the simulated host's authored state.

Category: Endpoint telemetry & host instrumentation
Package: osquery
Runs on: Linux · Windows
Commands: osqueryi, osqueryctl, osqueryd

Answers SQL queries from the simulated host's processes, users, files and services. No kernel probe is loaded.

Install it

The scripts below install the real Linux Foundation (originally Facebook) package on your own machine — read them first, and run them somewhere you are allowed to change. Inside the range, one press puts the simulated package on your next machine.

Linux installer (shell script)

install-osquery.sh

Windows installer (PowerShell)

Install-osquery.ps1

On a range machine

Add it to your kit and every machine you launch comes with it.

On Linux

Debian, Ubuntu, Kali (apt)

Refresh the package lists
```
sudo apt update
```
Install Osquery
```
sudo apt install -y osquery
```

RHEL, Fedora (dnf)

Install Osquery
```
sudo dnf install -y osquery
```
Package names drift between distributions; search first if this one misses.

Arch (pacman)

Install Osquery
```
sudo pacman -S --noconfirm osquery
```

Alpine (apk)

Install Osquery
```
sudo apk add osquery
```
Package names drift between distributions; search first if this one misses.

Check it worked

Confirm it landed on PATH
```
which osqueryi
```
Check the version
```
osqueryi --version
```
The range reports 5.12.1.

Remove it

Take it off again
```
sudo apt remove --purge osquery
```

On Windows

Windows Package Manager (winget)

Search the catalog
```
winget search osquery
```
Install Osquery
```
winget install --id osquery -e
```
Package names drift between distributions; search first if this one misses.

Chocolatey (choco)

Install Osquery
```
choco install osquery -y
```
Run the shell as administrator.

Check it worked

Confirm it resolves
```
where osqueryi
```
Check the version
```
osqueryi --version
```
The range reports 5.12.1.

Remove it

Take it off again
```
winget uninstall --id osquery
```

Inside the range

Tick it on the launch screen
Under Osquery's category on the advanced tool shelf. A lab that depends on it locks the toggle on and says why.
Or install it from a range terminal
```
sudo apt install -y osquery
```
The simulated package manager seeds the same binaries, config and receipt the shelf toggle does.
Everything here is simulated
No software is downloaded and nothing executes — the range answers from authored fixtures.

Labs that use Osquery

Pentest: Cloud Privilege EscalationGiven an access key with s3:GetObject only, walk a chain of over-permissive roles and trust policies to end up in a shell on a build server. File the trust-policy finding — the fix is one JSON edit.