https://github.com/osquery/osquery logo
u

Usama Nathani

10/12/2020, 5:50 PM
Hi Guys! I wanted to ask if anyone knew where the base FileEventSubscriber for windows is defined?
a

alessandrogario

10/12/2020, 7:18 PM
Hey Usama! There is no file integrity monitoring on Windows, but we (tob, or more specifically @yossarian) have implemented support for reading the NTFS journal
it's in the table named ntfs_journal_events
u

Usama Nathani

10/12/2020, 8:40 PM
okay thank you, I was trying to make yara_events work. Im still trying to implement it, fingers crossed
9 Views