CptOfEvilMinions
12/27/2019, 7:53 PMSELECT * FROM file WHERE path like '/Users/<user>/% it ONLY shows files and directories that do not have a name that is prepended with a . . Is this behavior expected or unexpected? If this is expected behavior is it possible to get all files including ones prepended with a .?
I tested on two macOS machines running Catalina with osquery versions 4.1.1 and 3.3.2.