[Osquery_manager] Logged users artifact saved query

[tomsonpl]

Logged In Users Artifact

The Logged In Users artifact provides comprehensive visibility into currently active user sessions across Windows, Linux, and macOS systems. This cross-platform query enables security teams to detect lateral movement, identify unauthorized access patterns, and perform user activity forensics by enumerating all authenticated sessions with detailed context including login timestamps, session types, and remote connection information.

Core Forensic Artifacts Coverage

#	Artifact	✓	OS	Query	File	Description
1	Logged In Users	✅	All	logged_in_users_elastic	ccd3f850	Cross-platform logged-in users enumeration with session details

Queries by Platform

---

🪟🍎🐧 Cross-Platform - Active Session Enumeration

Description

Enumerates all currently logged-in users across Windows, Linux, and macOS systems with comprehensive session details. The query retrieves login timestamps, usernames, logon types (console, remote, service), terminal/TTY information, remote host addresses for network sessions, and process IDs. On Windows, it additionally captures the user's Security Identifier (SID) and registry hive path for correlation with other forensic artifacts.

Detection Focus:

• Lateral Movement Detection: Identify remote logon sessions (RDP on Windows, SSH on Linux/macOS) that may indicate unauthorized access or attacker movement
• User Activity Forensics: Track user presence and session duration for incident timeline reconstruction
• Concurrent Session Analysis: Detect multiple simultaneous sessions from the same user account across different hosts
• Service Account Monitoring: Identify non-interactive service account logons that may indicate misuse
• Anomalous Access Patterns: Correlate login times with expected business hours and user behavior baselines

Result

Query results will show all active user sessions with the following information:

• Login timestamp (human-readable format)
• Username associated with the session
• Logon type (console, remote, pts, tty, etc.)
• Terminal/TTY device identifier
• Remote host address (for network sessions)
• Process ID of the session
• User SID (Windows only)
• Registry hive path (Windows only)

Platform

linux,darwin,windows

Interval

3600 seconds (1 hour)

Query ID

logged_in_users_elastic

ECS Field Mappings

• event.category → ["session"] (static value)
• event.action → osquery.logged_in_users (static value)
• user.name → username
• user.id → user_sid
• process.pid → pid
• source.address → remote_host
• tags → ["osquery", "user_activity", "session"] (static value)

SQL Query

-- Logged In Users Enumeration (Cross-Platform)
-- Lists all currently logged-in users with session details
-- Use case: User activity forensics, lateral movement detection, active session enumeration
-- Windows logon types: console (interactive), remote (RDP), service, etc.
-- Linux/macOS: pts (pseudo-terminal), tty (console), etc.
SELECT
  datetime(time, 'unixepoch') AS login_time,
  user AS username,
  type AS logon_type,
  tty,
  host AS remote_host,
  pid,
  sid AS user_sid,
  registry_hive
FROM logged_in_users
ORDER BY time DESC

Platform-Specific Notes

Windows

• Captures Security Identifier (SID) for user correlation with other Windows artifacts
• Registry hive path indicates user profile location
• Logon types distinguish between console (interactive), remote (RDP), and service logons

Linux/macOS

• TTY field indicates terminal type (pts for pseudo-terminals, tty for console)
• Remote host field populated for SSH and other remote connections
• Compatible with all major distributions (Ubuntu, RHEL, Debian, etc.)

[elasticmachine]

💔 Build Failed

• Buildkite Build
• Commit: 3f6f00b

Failed CI Steps

• Check integrations osquery_manager

History