https://github.com/osquery/osquery logo
Title
j

Jon

04/17/2023, 6:26 PM
Would anyone have a handle on the proper way to list files in a path? I am trying to identify some msmxl*.dll library files scattered about our environent. I thought that SELECT * FROM file WHERE path LIKE "/Windows/System32/msxml*.dll"; or maybe SELECT * FROM file WHERE path LIKE "/Windows/System32/msxml%%"; would do it but clearly I am incorrect. Any help is appreciated as I am an osquery noob.
z

zwass

04/17/2023, 6:29 PM
Can you give a couple of examples of the paths you'd like to match?
j

Jon

04/17/2023, 6:30 PM
the path will always be under the /windows/system32/ but the file names may be different. I am looking for a summary of files that exist that match the pattern filename#.dll
z

zwass

04/17/2023, 6:31 PM
Could there be additional directories, or will they be directly under system32?
j

Jon

04/17/2023, 6:31 PM
so the example is msxml3.dll msxml4r.dll msxml6.dll ...
this is currently the only place we are checking
m

Marcos Oviedo

04/17/2023, 6:32 PM
you can try something like this to get that file list
SELECT * FROM file WHERE directory='C:\\windows\\system32' AND filename LIKE 'msxml%.dll';
z

zwass

04/17/2023, 6:32 PM
Does
SELECT * FROM file WHERE path LIKE "/Windows/System32/msxml%.dll"
work?
Yeah, Marcos' should be equivalent
j

Jon

04/17/2023, 6:32 PM
zwass I trued that with no returns earlier but let me try your written example. Perhaps I mis entered something
I do like the 'like' clause let me try
Marcos gave me an error: osquery failed: query: out of order sequence response
Zwass yours is responding the same as my query did. perhaps the C:// is critical
z

zwass

04/17/2023, 6:35 PM
Yeah maybe try that
j

Jon

04/17/2023, 6:35 PM
err c:\\
that did it! had to removed the escaped \'s SELECT * FROM file WHERE path LIKE "C:\Windows\System32\msxml%.dll"
pretty literal I guess
m

Marcos Oviedo

04/17/2023, 6:37 PM
Jo, how are you testing this query? I've just double checked it by manually running it and it worked for me
z

zwass

04/17/2023, 6:37 PM
Yeah it can be a bit dependent on the context for how the double-backslashes are treated
j

Jon

04/17/2023, 6:37 PM
I am actually running this under my depoyed OSquery via Elastic agent may be a little funky
m

Marcos Oviedo

04/17/2023, 6:38 PM
good to know that! I was wondering how that error might end up appearing
j

Jon

04/17/2023, 6:38 PM
id bet if I removed those escape \'s it might fire. let see
actually... waiting for a reply..
well at any rate. you guys rule. thanks for helping me figure that out.. Yeah, it seems to require the drive letter and I totally blacked out on that one.
s

seph

04/19/2023, 1:24 PM
The main difference is that your query used
*
, but you need the sql wildcard is
%
.
The error
out of order sequence response
is a thrift error that is probably a bug somewhere. Are you running current versions?
j

Jon

04/20/2023, 4:58 PM
Hey seph. Yeah, I am up to date with whatever is deployed with the Elastic Agent Osquery integration .
s

seph

04/20/2023, 6:51 PM
I have no idea what version elastic ships.