Hi, can anyone tell me if it's possible to use %% with hidden directories/files, for example:
osquery> SELECT * FROM file WHERE path LIKE '/tmp/.test';
+------------+-----------+----------+----------+-----------+-----+------+--------+------+------------+------------+------------+------------+------------+------------+---------+---------+
| path | directory | filename | inode | uid | gid | mode | device | size | block_size | atime | mtime | ctime | btime | hard_links | symlink | type |
+------------+-----------+----------+----------+-----------+-----+------+--------+------+------------+------------+------------+------------+------------+------------+---------+---------+
| /tmp/.test | /tmp | .test | 21445705 | 757718729 | 0 | 0644 | 0 | 0 | 4096 | 1560351934 | 1560351927 | 1560351927 | 1560351927 | 1 | 0 | regular |
+------------+-----------+----------+----------+-----------+-----+------+--------+------+------------+------------+------------+------------+------------+------------+---------+---------+
osquery> SELECT * FROM file WHERE path = '/tmp/%%';
osquery>
osquery>
It works with explicit paths but doesn't seem to when using wildcards, as shown above.
Thanks.