Mystery Incorporated
11/15/2021, 11:14 PMzwass
11/15/2021, 11:16 PMfritz
11/16/2021, 12:11 AMSELECT
CONCAT(name,' ',version) AS operating_system,
(SELECT bundle_short_version
FROM apps
WHERE bundle_identifier = 'com.google.Chrome') AS chrome_version
FROM os_version;
+------------------+----------------+
| operating_system | chrome_version |
+------------------+----------------+
| macOS 11.6 | 95.0.4638.69 |
+------------------+----------------+
WITH
macos_admin_users AS (
SELECT
username,
uid
FROM users, user_groups USING(uid)
WHERE user_groups.gid = 80)
SELECT
username,
uid,
datetime(password_last_set_time, 'unixepoch') AS password_last_set
FROM account_policy_data, macos_admin_users USING (uid);
+-------------+-----+---------------------+
| username | uid | password_last_set |
+-------------+-----+---------------------+
| fritz | 502 | 2021-07-10 14:28:15 |
| kolide-imac | 501 | 2021-06-18 13:18:33 |
| root | 0 | |
+-------------+-----+---------------------+
account_policy_data
table which contains details like password set time.Mystery Incorporated
11/17/2021, 6:54 AM