shortstack02/13/2020, 8:15 PM
on a windows 10 endpoint, and it restarted the endpoint
msiexec /i C:\Windows\Temp\osquery-4.0.2.msi /qn
Stefano Bonicatti02/13/2020, 8:24 PM
to the installation command and block that behavior, unless it's a custom action. We can have a look into it but I don't think something custom is there.
shortstack02/13/2020, 9:06 PM