Would you please allow selects from ntfs_acl_permi...
# core
j
Would you please allow selects from ntfs_acl_permissions to use like rather than just = ?
m
If someone looks into doing this, I think it would be done with adding a call to
context.expandConstraints()
around line 150 in
genNtfsAclPerms()
in https://github.com/osquery/osquery/blob/master/osquery/tables/system/windows/ntfs_acl_permissions.cpp as demonstrated in many other tables