Severin Launiau
09/10/2020, 2:10 PMBen Montour
09/10/2020, 2:49 PMterracatta
09/10/2020, 3:41 PMBen Montour
09/10/2020, 3:43 PMSeverin Launiau
09/10/2020, 3:46 PMfritz
09/10/2020, 4:52 PMWin32_SoftwareFeature
with the property lastused
. Unfortunately, in practice this value is rarely updated/reliable and not all 'Software' seems to register itself with Win32_SoftwareFeature.
If you are using Kolide's launcher, then you can attempt to query this info using the kolide_wmi
launcher table using the following query:
WITH
wmi_raw AS (
SELECT * FROM kolide_wmi
WHERE class = 'Win32_SoftwareFeature'
AND properties = 'description,lastuse,productname'),
wmi_pivot AS (
SELECT
MAX(CASE WHEN key = 'description' THEN value END) AS description,
MAX(CASE WHEN key = 'productname' THEN value END) AS product_name,
MAX(CASE WHEN key = 'lastuse' THEN SUBSTR(value, 0, 9) END) AS last_use
FROM wmi_raw GROUP BY parent)
SELECT
product_name,
description,
CASE WHEN last_use = '19800000'
THEN 'Never'
ELSE last_use
END AS last_use
FROM wmi_pivot;
file.atime
of a given Program's executable path.asparamancer
01/13/2021, 5:49 PMSELECT programs.name, file.atime FROM programs LEFT JOIN file on programs.install_location = file.directory WHERE file.path LIKE '%%.exe' GROUP BY programs.name UNION SELECT 'NOTAPP', '';
it updates their last accessed time to the time of the queryfritz
01/13/2021, 5:50 PMasparamancer
01/14/2021, 2:26 AM