Eoin Miller
11/17/2019, 4:08 PMpath ends up being blank most of the time:
C:\Users\user\Desktop>osqueryi "SELECT count(*),image FROM drivers GROUP BY image" --json
[
{"count(*)":"98","image":""},
{"count(*)":"1","image":"C:\\Windows\\system32"}
]
I'd guess it should be enumerating the .sys files you see with driverquery /v ?:
...
WudfPf User Mode Driver Frame User Mode Driver Frame Kernel Manual
Stopped OK FALSE FALSE 4,096 69,632 0
11/20/2010 10:42:44 AM C:\Windows\system32\drivers\WudfPf.sys 8,192
...