Hi All.. Seeking some help to do some file search using osquery but couldn't find a way where it recursively searches all sub directories? Is it possible or not via osquery? I'm looking to find files with a particular exe name.

There is a

windows_search

table, but I don't know if that works for you or not.

using a %% in a query for the file table will do a recursive search so something like

SELECT * FROM FILE WHERE path LIKE "C:\%%" AND filename = "example.exe"

Tq for the input... Btw I'm trying on a mac.. I tried below but it's not listing any results... SELECT * FROM FILE WHERE path LIKE "/%%" AND filename = "<myexefilename>"

Sorry, you said

exe

and that made me think Windows. 🙂 Look at https://osquery.io/schema/5.11.0/#mdfind

Tried below query on mac but it gives below error... select path from mdfind where path like '/%%'; W0125 191723.492113 -648111040 virtual_table.cpp:975] Table mdfind was queried without a required column in the WHERE clause W0125 191723.492201 -648111040 virtual_table.cpp:986] Please see the table documentation: https://osquery.io/schema/#mdfind Error: constraint failed

You need to use the

query

column, not

path

. See

man mdfind

for query formats.