may have with a given file - such as hashing, and on-demand yara scans ( triggered via snapshot queries)?
09/08/2021, 12:20 PM
I'd have to check the source code to be sure, but I think yes for hashing and I'm unsure about yara
09/08/2021, 12:25 PM
Yara is not limited by that, since it reads files on its own
09/08/2021, 12:26 PM
Thanks for confirming!
09/08/2021, 12:39 PM
also doesn't apply to the
column(s) in the hash table
09/08/2021, 12:42 PM
If I'm joining on the table, and explicitly only pulling certain fields, will
and friends still be computed? As an example:
hash.md5 as md5, hash.sha1 as sha1, hash.sha256 as sha256 FROM processes JOIN hash USING
09/08/2021, 12:45 PM
it should not..
09/08/2021, 12:46 PM
Thanks for your help, folks 😄
09/08/2021, 12:59 PM
applies in places osquery reads the content of a file. In places where it’s passing a filename to some other library, that library may read the whole thing.
I’m not sure why anyone would know which hashing functions come out of which places. But it maybe helps understand why a join would be fine