osquery> select * from registry where hive like 'HKEY_LOCAL_MACHINE' and key = 'SYSTEM\\CurrentControlSet\\Services\\tedkol'; +--------------------+---------------------------------------------+---------------------------------------------+------+--------+------+------------+ | hive | key | subkey | name | type | data | mtime | +--------------------+---------------------------------------------+---------------------------------------------+------+--------+------+------------+ | HKEY_LOCAL_MACHINE | SYSTEM\\CurrentControlSet\\Services\\tedkol | SYSTEM\\CurrentControlSet\\Services\\tedkol | foo | REG_SZ | bar | 1475014767 | +--------------------+---------------------------------------------+---------------------------------------------+------+--------+------+------------+ osquery> select * from registry where hive like 'HKEY_LOCAL_MACHINE' and key = 'SYSTEM\CurrentControlSet\Services\tedkol'; +--------------------+------------------------------------------+------------------------------------------+------+--------+------+------------+ | hive | key | subkey | name | type | data | mtime | +--------------------+------------------------------------------+------------------------------------------+------+--------+------+------------+ | HKEY_LOCAL_MACHINE | SYSTEM\CurrentControlSet\Services\tedkol | SYSTEM\CurrentControlSet\Services\tedkol | foo | REG_SZ | bar | 1475014767 | +--------------------+------------------------------------------+------------------------------------------+------+--------+------+------------+ osquery>