Eoin Miller
02/18/2020, 7:21 PMscheduled_tasks
table when doing JOIN's against other tables such as file
and `hash`:
osquery> SELECT count(*) FROM scheduled_tasks;
| 162 |
When joining, we get an empty set response:
osquery> SELECT count(*) FROM scheduled_tasks JOIN file USING (path);
| 0 |
osquery> SELECT count(*) FROM scheduled_tasks JOIN hash USING (path);
| 0 |
I'll capture it in a GitHub issue, just wondering if this is know or others have encountered similiar?zwass
02/18/2020, 7:27 PMscheduled_tasks
path does not seem to be a filesystem pathEoin Miller
02/18/2020, 7:40 PMosquery> SELECT path FROM scheduled_tasks WHERE path LIKE "%testing%";
+----------+
| path |
+----------+
| \testing |
+----------+
A bit confusing, but also maybe more importantly, if it can't hash/file with a JOIN, should that create an empty set?zwass
02/18/2020, 7:40 PMEoin Miller
02/18/2020, 7:41 PMzwass
02/18/2020, 7:42 PMEoin Miller
02/18/2020, 7:48 PMpath
that is misleading or incorrect? The location of the task is what is being set to path
but the docs say:
> Path to the executable to be run
If path
were the path to the executable for this task, then it should be reporting back the value of "C:\Windows\System32\cmd.exe"zwass
02/18/2020, 7:50 PMpath
is the (relative) path to the task definition. A query like select * from scheduled_tasks s JOIN file f ON (f.path = '\Windows\System32\Tasks' || s.path);
may be what you want.action
column, but that is more tricky.action
may not be a simple path. Here's a value from running on my VM: %windir%\system32\ProvTool.exe /turn 5 /source LogonIdleTask
$(Arg1) %windir%\system32\gatherNetworkInfo.vbs
LEFT JOIN
to ensure you aren't dropping results.seph
02/18/2020, 9:02 PMIt would seem that doing a join should hopefully never cause you to lose data you would be collecting otherwise and all that.That doesn’t seem write. JOIN is a sql pragma. It does what join does. You might want a LEFT JOIN, or a JOIN, but fundamentally permuting data changes it.
zwass
02/19/2020, 1:06 AMEoin Miller
02/19/2020, 1:09 AMseph
02/19/2020, 1:09 AMhttps://www.lexo.ch/blog/wp-content/uploads/2012/06/Visual_SQL_JOINS_orig.jpg▾