I shall try that, maybe it will resolve some issues. I was previously using \\ after reading : https://blog.trailofbits.com/2020/03/16/real-time-file-monitoring-on-windows-with-osquery/ Maybe my code might be hindering the subscription of events, ill try to debug further and see if that resolves the issues. At the very least, the paths that are being subcsribed to in ntfs_journal_events should be subscribed in yara_events as well, and the rule specified is a dummy rule that always resolves true which should populate the table. Thank you again for your suggestions!