Osquery: Using D-Bus to query systemd data

Published

2020-10-14 12:00

Collected

2026-07-03 04:13

---
id: 1839
title: "Osquery: Using D-Bus to query systemd data"
source_domain: blog.trailofbits.com
source_url: "https://blog.trailofbits.com/2020/10/14/osquery-using-d-bus-to-query-systemd-data/"
published_at: "2020-10-14T12:00:17Z"
tags: ["endpoint-security", "linux", "threat-hunting", "osquery", "sql", "systemd", "dbus", "d-bus"]
phying_url: "https://phying.com/item/1839"
lang: en
---

# Osquery: Using D-Bus to query systemd data

## Summary

A Trail of Bits intern extended osquery on Linux: the startup_items table gained systemd support via the D-Bus API, plus a new systemd_units table for querying service data with SQL.

## Intelligence Metadata

- **Sources:** blog.trailofbits.com
- **Published:** 2020-10-14T12:00:17Z
- **Original:** https://blog.trailofbits.com/2020/10/14/osquery-using-d-bus-to-query-systemd-data/
- **Phying News:** https://phying.com/item/1839