select * from file where path = "/Users/redacted/working_dir/malicious_apps/Safari.app";

osquery planner: Opening cursor (2) for table: file
osquery planner: Adding constraint to cursor (2): path = /Users/redacted/working_dir/malicious_apps/Safari.app
osquery planner: Scanning rows for cursor (2)
osquery planner: Closing cursor (2)
+---------------------------------------------+----------------------------------+------------+----------+------------+-----------+------+--------+------+------------+------------+------------+------------+------------+------------+-----------+
| path                                        | directory                        | filename   | inode    | uid        | gid       | mode | device | size | block_size | atime      | mtime      | ctime      | btime      | hard_links | type      |
+---------------------------------------------+----------------------------------+------------+----------+------------+-----------+------+--------+------+------------+------------+------------+------------+------------+------------+-----------+
| /Users/redacted/working_dir/malicious_apps/Safari.app | /Users/redacted/working_dir/malicious_apps | Safari.app | 55564330 | 1231019068 | 849048494 | 0755 | 0      | 102  | 4096       | 1519849176 | 1519705354 | 1519849167 | 1519399970 | 3          | directory |
+---------------------------------------------+----------------------------------+------------+----------+------------+-----------+------+--------+------+------------+------------+------------+------------+------------+------------+-----------+

select * from file where path = "/Users/redacted/working_dir/malicious_apps/Safari.app/Contents/Info.plist";

osquery planner: Opening cursor (3) for table: file
osquery planner: Adding constraint to cursor (3): path = /Users/redacted/working_dir/malicious_apps/Safari.app/Contents/Info.plist
osquery planner: Scanning rows for cursor (3)
osquery planner: Closing cursor (3)
+-----------------------------------------------------------------+------------------------------------------------------+------------+----------+------------+-----------+------+--------+------+------------+------------+------------+------------+------------+------------+---------+
| path                                                            | directory                                            | filename   | inode    | uid        | gid       | mode | device | size | block_size | atime      | mtime      | ctime      | btime      | hard_links | type    |
+-----------------------------------------------------------------+------------------------------------------------------+------------+----------+------------+-----------+------+--------+------+------------+------------+------------+------------+------------+------------+---------+
| /Users/redacted/working_dir/malicious_apps/Safari.app/Contents/Info.plist | /Users/redacted/working_dir/malicious_apps/Safari.app/Contents | Info.plist | 55564340 | 1231019068 | 849048494 | 0644 | 0      | 1428 | 4096       | 1519849178 | 1519849167 | 1519849167 | 1519399969 | 1          | regular |
+-----------------------------------------------------------------+------------------------------------------------------+------------+----------+------------+-----------+------+--------+------+------------+------------+------------+------------+------------+------------+---------+