fritz
07/20/2021, 7:58 PMkolide_wmi
table, if you have only vanilla osquery you can get a little more brittle and cobble something together using the registry
table like so:wkleinhenz
07/20/2021, 7:59 PMfritz
07/20/2021, 8:00 PMwkleinhenz
07/20/2021, 8:01 PMfritz
07/20/2021, 8:01 PM