[tomsonpl]

Summary

This PR adds 7 new Windows Amcache saved queries to the osquery_manager integration and includes all of them in the existing forensic-process-execution pack. The queries provide full coverage of the Windows Amcache.hve registry hive — a forensic artifact that records metadata about binaries present on the system including file paths, SHA1 hashes, timestamps, and installation/interaction history.

The Amcache hive is structured around 6 distinct inventory keys (InventoryApplication, InventoryApplicationFile, InventoryApplicationShortcut, InventoryDriverBinary, InventoryDriverPackage, InventoryDevicePnp). This PR covers all 6 via dedicated queries, plus 2 additional enriched cross-table JOIN queries that correlate related artifacts together into single-query views.

Requirement: All Amcache queries require Elastic Agent with the osquery extension amcache support (elastic_amcache_* tables). These are not standard osquery tables — they are provided by the Elastic Agent osquery extension.

Important note on execution evidence: Amcache records the presence of binaries on the filesystem but does not reliably prove execution in all cases. Execution evidence should be corroborated with additional artifacts: Prefetch, ShimCache/AppCompatCache, UserAssist, and Event Logs.

---

Coverage Added

#	Artifact	OS	Query ID	File	MITRE ATT&CK
2	AmCache (Applications)	🪟 Win	amcache_application_forensics_windows_elastic	5b2e3867	T1204
2a	AmCache (Drivers)	🪟 Win	amcache_driver_forensics_windows_elastic	d55fb469	T1014, T1068
2b	AmCache (Shortcuts)	🪟 Win	amcache_shortcut_windows_elastic	c1382246	T1204, T1547.009
2c	AmCache (Device PnP)	🪟 Win	amcache_device_pnp_windows_elastic	5bc9de27	T1200, T1052
2d	AmCache (Driver Packages)	🪟 Win	amcache_driver_package_windows_elastic	bcef7e6e	T1014, T1068
2e	AmCache (Application Enriched)	🪟 Win	amcache_application_enriched_windows_elastic	abed45b1	T1204, T1547.009
2f	AmCache (Driver Enriched)	🪟 Win	amcache_driver_enriched_windows_elastic	743c6727	T1014, T1068, T1200

Pack updated: forensic-process-execution — all 7 queries added (c8a1b2d3)

---

Query Details

---

🪟 Amcache Application Forensics — amcache_application_forensics_windows_elastic

Description

Combined application and file inventory from the Windows Amcache.hve registry hive. Enumerates installed applications and their associated binary files with SHA1 hashes, publishers, install dates, file paths, binary types, and USN journal references. The view merges InventoryApplication and InventoryApplicationFile into a unified result.

Detection Focus

• Application installation and binary presence evidence for incident response timelines
• SHA1 hashes for threat intelligence lookups and VirusTotal correlation
• Publisher and product name fields for unsigned/unknown software identification
• USN journal references to correlate with NTFS file system change records
• User SID context to attribute software installations to specific accounts

Platform

Windows

Interval

3600 seconds (1 hour)

Timeout

180 seconds

Query ID

amcache_application_forensics_windows_elastic

File

osquery_manager-5b2e3867-a277-4269-b3eb-9158d10965df.json

ECS Field Mappings

• event.category → ["process"]
• event.type → ["info"]
• event.action → "osquery.amcache_application"
• file.path → lower_case_long_path
• file.name → name
• file.hash.sha1 → file_sha1
• file.size → size
• package.name → product_name
• package.version → product_version
• user.id → user_sid
• tags → ["osquery", "amcache", "forensics", "execution_artifacts", "windows"]

SQL Query

-- Amcache Application Forensics: Combined application and file inventory
-- Source: elastic_amcache_applications_view (Amcache.hve registry hive)
-- Forensic value: Application execution/installation evidence with SHA1 hashes
-- NOTE: Execution must be corroborated with additional artifacts

SELECT
  *,
  datetime(timestamp, 'unixepoch') AS record_time
FROM elastic_amcache_applications_view
WHERE name IS NOT NULL AND name != ''
ORDER BY timestamp DESC;

---

🪟 Amcache Driver Forensics — amcache_driver_forensics_windows_elastic

Description

Enumerates driver binaries recorded in the Windows Amcache.hve registry hive (Root\InventoryDriverBinary). Identifies unsigned drivers, third-party kernel-mode drivers, and out-of-box drivers. Results are sorted with unsigned and kernel-mode drivers first for rapid forensic triage. Useful for detecting rootkits, vulnerable drivers (BYOVD — Bring Your Own Vulnerable Driver), and unauthorized driver installations.

Detection Focus

• Unsigned drivers (driver_signed != '1') surfaced first in results for immediate triage
• Kernel-mode drivers (driver_is_kernel_mode = '1') which execute in ring-0 and represent the highest privilege level
• Out-of-box (OOB) indicator distinguishes Windows inbox drivers from third-party introductions
• BYOVD attack vector: adversaries load known-vulnerable signed drivers to disable security products or escalate privileges
• Rootkit detection: malicious drivers loaded outside standard Windows driver signing workflows

Platform

Windows

Interval

7200 seconds (2 hours)

Timeout

180 seconds

Query ID

amcache_driver_forensics_windows_elastic

File

osquery_manager-d55fb469-b20d-43aa-902a-f0e71cf036a6.json

ECS Field Mappings

• event.category → ["driver"]
• event.type → ["info"]
• event.action → "osquery.amcache_driver"
• file.name → driver_name
• file.code_signature.subject_name → driver_company
• file.code_signature.signed → is_signed
• package.name → product
• package.version → product_version
• tags → ["osquery", "amcache", "forensics", "driver_analysis", "windows"]

SQL Query

-- Amcache Driver Forensics: Driver binary inventory from Amcache
-- Source: elastic_amcache_driver_binary (Root\InventoryDriverBinary)
-- Forensic value: Identifies unsigned, third-party, and kernel-mode drivers
-- Use case: Rootkit detection, BYOVD (Bring Your Own Vulnerable Driver), unauthorized drivers

SELECT
  *,
  datetime(timestamp, 'unixepoch') AS record_time,
  CASE
    WHEN driver_signed = '1' THEN 'true'
    ELSE 'false'
  END AS is_signed
FROM elastic_amcache_driver_binary
ORDER BY
  CASE WHEN driver_signed != '1' THEN 0 ELSE 1 END,
  CASE WHEN driver_is_kernel_mode = '1' THEN 0 ELSE 1 END,
  CASE WHEN driver_in_box != '1' THEN 0 ELSE 1 END,
  timestamp DESC;

---

🪟 Amcache Application Shortcuts — amcache_shortcut_windows_elastic

Description

Enumerates LNK (shortcut) files recorded in the Windows Amcache.hve registry hive (Root\InventoryApplicationShortcut). Tracks Start Menu shortcuts with their target paths and program associations. Useful for forensic investigation of application execution evidence and persistence mechanisms via Start Menu manipulation.

Detection Focus

• Start Menu LNK file inventory with target executable paths
• Program ID cross-reference to correlate shortcuts with application records
• Shortcut creation timestamps for timeline analysis
• Persistence via shortcut modification: adversaries plant or modify LNK files to achieve execution at user logon or via social engineering
• Application uninstall gap detection: shortcuts that remain after application removal

Platform

Windows

Interval

3600 seconds (1 hour)

Timeout

180 seconds

Query ID

amcache_shortcut_windows_elastic

File

osquery_manager-c1382246-e840-4270-b095-677b6c6be796.json

ECS Field Mappings

• event.category → ["file"]
• event.type → ["info"]
• event.action → "osquery.amcache_shortcut"
• file.path → shortcut_path
• tags → ["osquery", "amcache", "forensics", "shortcuts", "execution_artifacts", "windows"]

SQL Query

-- Amcache Application Shortcuts: Start Menu shortcut inventory
-- Source: elastic_amcache_application_shortcut (Root\InventoryApplicationShortcut)
-- Forensic value: Tracks LNK files for execution evidence and persistence analysis

SELECT
  *,
  datetime(timestamp, 'unixepoch') AS record_time
FROM elastic_amcache_application_shortcut
WHERE shortcut_path IS NOT NULL AND shortcut_path != ''
ORDER BY timestamp DESC;

---

🪟 Amcache Device PnP — amcache_device_pnp_windows_elastic

Description

Enumerates Plug and Play device history from the Windows Amcache.hve registry hive (Root\InventoryDevicePnp). Records USB, Bluetooth, and peripheral device connections with manufacturer, model, driver information, install dates, and hardware IDs. Useful for forensic investigation of unauthorized device connections, data exfiltration via removable media, and hardware-based attacks.

Detection Focus

• USB and removable media connection history for data exfiltration investigations
• Bluetooth device pairing history for wireless data transfer analysis
• Hardware ID and compatible IDs for device type classification
• First install date vs. last seen timestamps for connection frequency analysis
• Driver association reveals which binaries were loaded to service each device
• Problem codes identify devices that failed installation or were blocked

Platform

Windows

Interval

7200 seconds (2 hours)

Timeout

180 seconds

Query ID

amcache_device_pnp_windows_elastic

File

osquery_manager-5bc9de27-6ae5-4148-b087-97d2669f6f27.json

ECS Field Mappings

• event.category → ["host"]
• event.type → ["info"]
• event.action → "osquery.amcache_device_pnp"
• tags → ["osquery", "amcache", "forensics", "device_inventory", "usb_forensics", "windows"]

SQL Query

-- Amcache Device PnP: Plug and Play device history
-- Source: elastic_amcache_device_pnp (Root\InventoryDevicePnp)
-- Forensic value: USB, Bluetooth, and peripheral device connection history
-- Use case: Unauthorized device detection, data exfiltration investigation

SELECT
  *,
  datetime(timestamp, 'unixepoch') AS record_time
FROM elastic_amcache_device_pnp
ORDER BY timestamp DESC;

---

🪟 Amcache Driver Packages — amcache_driver_package_windows_elastic

Description

Enumerates driver package metadata from the Windows Amcache.hve registry hive (Root\InventoryDriverPackage). Records package class, version, provider, directory, and associated hardware IDs. Links to both DeviceContainers and DevicePnPs for cross-referencing driver provenance. Complements the driver binary query by providing the package-level view of driver introductions.

Detection Focus

• Driver package class and class GUID for categorizing driver types (display, network, USB, filter, etc.)
• Provider name to distinguish Microsoft-supplied packages from third-party introductions
• Install directory to detect drivers placed in non-standard locations
• Hardware ID coverage to map which devices triggered a driver package installation
• INF file path for tracking driver installation source files
• Version information for known vulnerable driver version matching (BYOVD threat hunting)

Platform

Windows

Interval

7200 seconds (2 hours)

Timeout

180 seconds

Query ID

amcache_driver_package_windows_elastic

File

osquery_manager-bcef7e6e-31df-4d72-a296-2e7657f49d64.json

ECS Field Mappings

• event.category → ["driver"]
• event.type → ["info"]
• event.action → "osquery.amcache_driver_package"
• tags → ["osquery", "amcache", "forensics", "driver_analysis", "windows"]

SQL Query

-- Amcache Driver Packages: Driver package metadata from Amcache
-- Source: elastic_amcache_driver_package (Root\InventoryDriverPackage)
-- Forensic value: Driver provenance, package class, provider, associated hardware IDs

SELECT
  *,
  datetime(timestamp, 'unixepoch') AS record_time
FROM elastic_amcache_driver_package
ORDER BY timestamp DESC;

---

🪟 Amcache Application Enriched — amcache_application_enriched_windows_elastic

Description

Full application forensics view joining application inventory, file details, and Start Menu shortcuts from the Windows Amcache.hve registry hive. Combines elastic_amcache_applications_view (merging InventoryApplication + InventoryApplicationFile) with InventoryApplicationShortcut via program_id. Provides a single-query view of every installed application with its associated binary files and shortcut launch points. This is a superset of the standalone Application Forensics (#2) and Shortcuts (#2b) queries.
Screenshot 2026-03-30 at 13.25.44

Detection Focus

• End-to-end application picture: application record + all associated binaries + all associated Start Menu shortcuts in one result set
• program_id join key correlates the application-level record with its file-level and shortcut-level records
• shortcut_aumid (Application User Model ID) useful for identifying Store/Modern apps vs. Win32 applications
• shortcut_target_path compared to lower_case_long_path detects mismatches that may indicate shortcut hijacking
• Reduced analyst overhead vs. correlating three separate query results manually
• NOTE: Execution must be corroborated with additional artifacts (Prefetch, ShimCache, UserAssist)

Platform

Windows

Interval

3600 seconds (1 hour)

Timeout

180 seconds

Query ID

amcache_application_enriched_windows_elastic

File

osquery_manager-abed45b1-6b61-4398-b607-a7a6b09e6dc6.json

ECS Field Mappings

• event.category → ["process"]
• event.type → ["info"]
• event.action → "osquery.amcache_application_enriched"
• file.path → lower_case_long_path
• file.name → name
• file.hash.sha1 → file_sha1
• file.size → size
• package.name → product_name
• package.version → product_version
• user.id → user_sid
• tags → ["osquery", "amcache", "forensics", "execution_artifacts", "combined", "windows"]

SQL Query

-- Amcache Application Enriched: App inventory + file details + shortcuts
-- Source: elastic_amcache_applications_view + elastic_amcache_application_shortcut
-- Join: program_id = shortcut_program_id
-- Forensic value: Full application forensics with shortcut launch points
-- NOTE: Execution must be corroborated with additional artifacts

SELECT
  av.*,
  s.shortcut_path,
  s.shortcut_target_path,
  s.shortcut_aumid,
  datetime(av.timestamp, 'unixepoch') AS record_time
FROM elastic_amcache_applications_view AS av
LEFT JOIN elastic_amcache_application_shortcut AS s
  ON av.program_id = s.shortcut_program_id
WHERE av.name IS NOT NULL AND av.name != ''
ORDER BY av.timestamp DESC;

---

🪟 Amcache Driver Enriched — amcache_driver_enriched_windows_elastic

Description

Full driver forensics view joining driver binaries with PnP device history from the Windows Amcache.hve registry hive. Combines InventoryDriverBinary with InventoryDevicePnp via service name — the runtime binding that links a driver binary to the physical device(s) it services. Results sorted with unsigned and kernel-mode drivers first for rapid forensic triage. This is a superset of the standalone Driver Forensics (#2a) and Device PnP (#2c) queries.

Device columns are prefixed with device_ to avoid column name collisions when both tables share field names (timestamp, description, driver_name, etc.).

Detection Focus

• Driver-to-device correlation: which physical USB, Bluetooth, or other PnP device caused a driver binary to be installed
• device_problem_code identifies devices that failed to load or were blocked — potential indicator of driver conflicts or security product interference
• device_enumerator (USB, ACPI, PCI, etc.) distinguishes removable media drivers from built-in hardware drivers
• device_first_install_date vs. device_install_date reveals whether a device reappeared after a prior removal
• Combined unsigned + kernel-mode ordering ensures BYOVD and rootkit indicators appear first in analyst workflows
• device_hw_id and device_compid enable matching against public lists of known-vulnerable hardware IDs

Platform

Windows

Interval

7200 seconds (2 hours)

Timeout

180 seconds

Query ID

amcache_driver_enriched_windows_elastic

File

osquery_manager-743c6727-2a18-46cc-9e23-215ca38b3373.json

ECS Field Mappings

• event.category → ["driver"]
• event.type → ["info"]
• event.action → "osquery.amcache_driver_enriched"
• file.name → driver_name
• file.code_signature.subject_name → driver_company
• file.code_signature.signed → is_signed
• package.name → product
• package.version → product_version
• tags → ["osquery", "amcache", "forensics", "driver_analysis", "device_inventory", "combined", "windows"]

SQL Query

-- Amcache Driver Enriched: Driver binaries + PnP device history
-- Source: elastic_amcache_driver_binary + elastic_amcache_device_pnp
-- Join: service name (runtime binding between driver and device)
-- Forensic value: Which physical devices use each driver binary
-- Note: device columns prefixed with device_ to avoid collisions with driver columns

SELECT
  db.*,
  dp.timestamp AS device_timestamp,
  dp.date_time AS device_date_time,
  dp.model AS device_model,
  dp.manufacturer AS device_manufacturer,
  dp.description AS device_description,
  dp.driver_name AS device_driver_name,
  dp.class AS device_class,
  dp.class_guid AS device_class_guid,
  dp.enumerator AS device_enumerator,
  dp.service AS device_service,
  dp.install_state AS device_install_state,
  dp.device_state,
  dp.inf AS device_inf,
  dp.driver_ver_date,
  dp.install_date AS device_install_date,
  dp.first_install_date AS device_first_install_date,
  dp.driver_package_strong_name AS device_driver_package,
  dp.driver_ver_version AS device_driver_version,
  dp.container_id AS device_container_id,
  dp.problem_code AS device_problem_code,
  dp.provider AS device_provider,
  dp.driver_id AS device_driver_id,
  dp.bus_reported_description AS device_bus_description,
  dp.hw_id AS device_hw_id,
  dp.extended_infs AS device_extended_infs,
  dp.compid AS device_compid,
  dp.stack_id AS device_stack_id,
  dp.upper_class_filters AS device_upper_class_filters,
  dp.lower_class_filters AS device_lower_class_filters,
  dp.upper_filters AS device_upper_filters,
  dp.lower_filters AS device_lower_filters,
  dp.device_interface_classes,
  dp.location_paths AS device_location_paths,
  dp.parent_id AS device_parent_id,
  dp.matching_id AS device_matching_id,
  datetime(db.timestamp, 'unixepoch') AS record_time,
  CASE WHEN db.driver_signed = '1' THEN 'true' ELSE 'false' END AS is_signed
FROM elastic_amcache_driver_binary AS db
LEFT JOIN elastic_amcache_device_pnp AS dp
  ON db.service = dp.service
  AND dp.service != ''
ORDER BY
  CASE WHEN db.driver_signed != '1' THEN 0 ELSE 1 END,
  CASE WHEN db.driver_is_kernel_mode = '1' THEN 0 ELSE 1 END,
  CASE WHEN db.driver_in_box != '1' THEN 0 ELSE 1 END,
  db.timestamp DESC;

---

Pack Update: forensic-process-execution

All 7 Amcache queries have been added to the existing forensic-process-execution pack. The pack description has been updated to reflect the expanded Amcache coverage:

"Forensic pack for process execution and Amcache analysis — prefetch, shimcache, process listing, suspicious process detection across all platforms, plus Windows Amcache application inventory, driver forensics, shortcuts, device PnP, and enriched views."

Pack file: osquery_manager-c8a1b2d3-e4f5-4a6b-8c7d-9e0f1a2b3c4d.json

---

Query Design Notes

Why separate atomic queries AND enriched JOIN queries?

The 5 atomic queries (Application, Drivers, Shortcuts, Device PnP, Driver Packages) each target a single Amcache inventory key. They are fast, low-overhead, and appropriate for scheduled collection with high frequency. The 2 enriched queries (Application Enriched, Driver Enriched) perform cross-table JOINs and are designed for incident response scenarios where the analyst needs a complete correlated picture in a single query result.

In practice:

• Use atomic queries for baseline scheduled collection and change detection
• Use enriched queries during active investigations when correlation context is needed immediately

Result ordering strategy

The Driver Forensics and Driver Enriched queries use a multi-level ORDER BY with CASE expressions to prioritize the most forensically significant records first:

1. Unsigned drivers (driver_signed != '1') — highest risk, surface first
2. Kernel-mode drivers (driver_is_kernel_mode = '1') — ring-0 execution context
3. Non-inbox (third-party) drivers (driver_in_box != '1') — not shipped with Windows
4. Most recently seen (timestamp DESC) — most recent activity first within each group

Amcache.hve structure reference

Amcache Key	osquery Table	Query
InventoryApplication + InventoryApplicationFile	elastic_amcache_applications_view	Application Forensics, Application Enriched
InventoryApplicationShortcut	elastic_amcache_application_shortcut	Shortcuts, Application Enriched
InventoryDriverBinary	elastic_amcache_driver_binary	Driver Forensics, Driver Enriched
InventoryDriverPackage	elastic_amcache_driver_package	Driver Packages
InventoryDevicePnp	elastic_amcache_device_pnp	Device PnP, Driver Enriched

Prerequisite: Elastic Agent osquery extension amcache support

The elastic_amcache_* tables are not part of the standard osquery table set. They are provided by the Elastic Agent osquery extension. Agents must be running a version of Elastic Agent that ships the amcache extension tables. Queries will return no results (not errors) on agents where the extension is not loaded.

[github-actions]

Vale Linting Results

Summary: 4 warnings, 1 suggestion found

⚠️ Warnings (4)

File	Line	Rule	Message
packages/osquery_manager/artifacts_matrix.md	35	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/osquery_manager/artifacts_matrix.md	40	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/osquery_manager/artifacts_matrix.md	41	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/osquery_manager/artifacts_matrix.md	42	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.

💡 Suggestions (1)

File	Line	Rule	Message
packages/osquery_manager/artifacts_matrix.md	40	Elastic.WordChoice	Consider using 'open' instead of 'launch', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[calladoum-elastic]

minor comments, otherwise good

[calladoum-elastic]

Records package class, version, provider, directory, and associated hardware IDs.

Those fields don't seem to be exposed to ES?

Also isn't this redundant with d55fb469-b20d-43aa-902a-f0e71cf036a6 ?

[tomsonpl]

Records package class, version, provider, directory, and associated hardware IDs.

Those fields don't seem to be exposed to ES?

Good catch — I've added ECS mappings for package.version → version and file.path → inf (the INF file that describes the driver package). The remaining fields (class, class_guid, provider, directory, hwids) still land in ES under their raw osquery column names via SELECT *, but there's no natural ECS field to map them to.

Also isn't this redundant with d55fb469?
Imho they're complementary, not redundant. They query different Amcache tables:

• d55fb469 (Driver Forensics) : elastic_amcache_driver_binary (Root\InventoryDriverBinary) - individual driver binaries with signing status, kernel-mode flag, company name
• bcef7e6e (Driver Packages) : elastic_amcache_driver_package (Root\InventoryDriverPackage) - the installation packages that delivered those drivers: INF path, class, provider, hardware IDs

Is that ok?

[calladoum-elastic]

Wondering if event.action is fit here. Maybe event.provider ?
Not a blocker

[tomsonpl]

Changed 👍

[calladoum-elastic]

Suggestion: Since you've already identified in the descriptions for each artifact collected the associated MITRE code, it could be useful for DFIR to also add it as a tag so it can be queried directly?

[tomsonpl]

That's a left over, I am going to remove the MITRE as we do not use it in any other queries. Sorry for the noise!

[calladoum-elastic]

Nit: the link to SSI Gouv.fr doesn't bring you to the PDF, but to the generic page

Suggested change

"description": "Amcache Application Forensics: Combined application and file inventory from the Windows Amcache.hve registry hive. Enumerates installed applications and associated binary files with SHA1 hashes, publishers, install dates, file paths, binary types, and USN journal references. The Amcache records metadata about binaries present on the system including file paths, hashes, timestamps, and install/interaction information. NOTE: Execution must be corroborated with additional artifacts (Prefetch, ShimCache, UserAssist). MITRE ATT&CK: T1204 (User Execution). References: https://www.ssi.gouv.fr/uploads/2019/01/anssi-coriin_2019-analysis_amcache.pdf",

"description": "Amcache Application Forensics: Combined application and file inventory from the Windows Amcache.hve registry hive. Enumerates installed applications and associated binary files with SHA1 hashes, publishers, install dates, file paths, binary types, and USN journal references. The Amcache records metadata about binaries present on the system including file paths, hashes, timestamps, and install/interaction information. NOTE: Execution must be corroborated with additional artifacts (Prefetch, ShimCache, UserAssist). MITRE ATT&CK: T1204 (User Execution). References: https://cyber.gouv.fr/documents/632/anssi-coriin_2019-analysis_amcache-v2.pdf",

[tomsonpl]

Thanks, that's a good catch. In the end I decided to remove it - since we do not reference any analysis elsewhere.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 6f20f4a

History

• 💔 Build #41321 failed 066ad89
• 💚 Build #40544 succeeded a4ce4fa
• 💚 Build #40534 succeeded ff31e62

cc @tomsonpl

[elastic-vault-github-plugin-prod]

Package osquery_manager - 1.27.0 containing this change is available at https://epr.elastic.co/package/osquery_manager/1.27.0/