CptOfEvilMinions
12/27/2019, 7:53 PMSELECT * FROM file WHERE path like '/Users/<user>/%
it ONLY shows files and directories that do not have a name that is prepended with a .
. Is this behavior expected or unexpected? If this is expected behavior is it possible to get all files including ones prepended with a .
?
I tested on two macOS machines running Catalina with osquery versions 4.1.1 and 3.3.2.