Eoin Miller
02/13/2020, 12:41 AMusers-Mac:~ user$ sudo osqueryi 'SELECT * FROM hash WHERE path = "/private/var/db/dslocal/nodes/Default/sqlindex"' --json
W0212 16:33:37.699832 448591296 hash.cpp:195] ssdeep failed: /private/var/db/dslocal/nodes/Default/sqlindex
[
{"directory":"/private/var/db/dslocal/nodes/Default","md5":"","path":"/private/var/db/dslocal/nodes/Default/sqlindex","sha1":"","sha256":"","ssdeep":"-1"}
]
Returning a -1
and putting that to the ssdeep value instead of an empty string also seems out of the ordinary.
https://github.com/osquery/osquery/blob/master/osquery/tables/system/hash.cpp#L194-L196theopolis
02/13/2020, 2:43 PMEoin Miller
02/13/2020, 8:25 PM