Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Afternoon :wave: we've hit an issue for macOS it appears `interface_details` in Sequoia or later; returns the randomized HWAddress and not the actual hardware HWAddress; is anyone aware of an alternative method for gaining the underlying hardware address for macOS deployments (thanks! and I'll updating in comment thread if I find this whilst researching myself).

To reproduce:


```/usr/sbin/networksetup -getmacaddress Wi-Fi
Ethernet Address: 5c:&lt;redacted&gt; (Hardware Port: Wi-Fi)
osquery&gt; SELECT * FROM interface_details where mac like '5c%';
osquery&gt; 
osquery&gt; .mode lines
osquery&gt; SELECT mac FROM interface_details where interface = 'en0';
  mac = 02:&lt;redacted&gt;```
As can be seen the returned interface_details is the randomized address, and not the underlying hardware_address :thinking_face:

As promised:

```SELECT 
    key, 
    subkey, 
    UPPER(
        SUBSTR(hex(from_base64(value)), 1, 2) || ':' ||
        SUBSTR(hex(from_base64(value)), 3, 2) || ':' ||
        SUBSTR(hex(from_base64(value)), 5, 2) || ':' ||
        SUBSTR(hex(from_base64(value)), 7, 2) || ':' ||
        SUBSTR(hex(from_base64(value)), 9, 2) || ':' ||
        SUBSTR(hex(from_base64(value)), 11, 2)
    ) AS mac_address
FROM plist 
WHERE path = '/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist' 
AND subkey = 'IOMACAddress';```
Produces an output with the mac addresses of all interfaces within the plist file, no elevated permissions required.