Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Seeing a particularly perplexing issue with joining the `yara` table with `file` table;

When using file.path LIKE ... I get `W0610 17:28:28.487862 3055360 yara.cpp:262] YARA compile error: osquery::YaraCompilerError[0] (Compilation error 1)` when I implicitly set the file.path to _some_ file (or a non existant file) I do not get the error;

Intention here is to use yara.sigrule to leverage an inline yara rule for detection testing of a variant of the <https://www.cloudsek.com/blog/amos-variant-distributed-via-clickfix-in-spectrum-themed-dynamic-delivery-campaign-by-russian-speaking-hackers|AMOS Malware>

Can anyone point me in the right direction to debug this further ?

Thanks!

e.g.


`SELECT f.path FROM file f JOIN yara y ON y.path = f.path
WHERE f.path = '/tmp/some_non_existing_file ...` is OK whilst

`SELECT f.path FROM file f JOIN yara y ON y.path = f.path
WHERE f.path LIKE '/tmp/%' ...` throws the error

path is a mandatory argument for the osquery yara table

thanks not sure what I was thinking joining file table going to take another look.