thor
C:\ProcessExplorer\%
Mustafa
04/05/2018, 1:30 PMmanu
04/05/2018, 2:09 PMpath
here refers to file
, u seem to be passing directory here. something like select * from authenticode where path = "c:\windows\system32\kernel32.dll";
files
via file
table and do sort of join
with authenticode to get it for all files in the directory.
Some SQL expert might help in here, i don't really know much of SQL.
https://osquery.io/schema/2.11.2#fileMustafa
04/05/2018, 2:43 PMmanu
04/05/2018, 2:58 PMselect * from authenticode where path like 'C:\ProcessExplorer\%';
Mustafa
04/05/2018, 3:07 PM