<@U1EUNPP63> <@U55R9FC1Z> something like this: ```...
# macos
t
@groob @cminus something like this:
Copy code
$ osqueryi --list --noheader "select file.path from package_receipts, package_bom, file where package_id like '%osquery%' and package_bom.path = replace(package_receipts.path, '.plist', '.bom') and file.path = replace(package_bom.filepath, './', '/') and type = 'regular';"
/private/var/osquery/com.facebook.osqueryd.conf
/private/var/osquery/com.facebook.osqueryd.plist
/private/var/osquery/osquery.example.conf
/private/var/osquery/certs/certs.pem
/private/var/osquery/packs/hardware-monitoring.conf
/private/var/osquery/packs/incident-response.conf
/private/var/osquery/packs/it-compliance.conf
/private/var/osquery/packs/osquery-monitoring.conf
/private/var/osquery/packs/osx-attacks.conf
/private/var/osquery/packs/vuln-management.conf
/usr/local/bin/osqueryctl
/usr/local/bin/osqueryd
/usr/local/bin/osqueryi
you can pipe to
sudo xargs rm
🔥 1