On a default Win7x64 w/4.0.2, it looks like `path`...
# general
e
On a default Win7x64 w/4.0.2, it looks like
path
ends up being blank most of the time:
Copy code
C:\Users\user\Desktop>osqueryi "SELECT count(*),image FROM drivers GROUP BY image" --json
[
  {"count(*)":"98","image":""},
  {"count(*)":"1","image":"C:\\Windows\\system32"}
]
I'd guess it should be enumerating the .sys files you see with
driverquery /v
?:
Copy code
...
WudfPf       User Mode Driver Frame User Mode Driver Frame Kernel        Manual
    Stopped    OK         FALSE       FALSE        4,096      69,632     0
11/20/2010 10:42:44 AM C:\Windows\system32\drivers\WudfPf.sys           8,192
...