Hello While running osquery on windows osquery ATC has anyon

Question

Hello While running osquery on windows osquery ATC has anyone come across this Will not autoload extension with unsafe directory permissions C Program Files osquery extensions macadmins exe

namali · Answer

I ran it with a allow unsafe flag and it initialized osquery but then I got a popup the image file macadmins exe is valid but is for machine type other than the current machine Not sure I understand what is going on here Can someone help on this please I am trying to retrieve browser files using osquery atc on Windows

sharvil · Answer

macadmins exe on windows sounds weird are you trying to load a mac extension on windows

namali · Answer

I am trying to use this ATC conf here ``` auto table construction chrome history query SELECT datetime last visit time 1000000 11644473600 unixepoch as last visited url title visit count FROM urls path C Users AppData Local Google Chrome User Data History columns last visited url title visit count ```

sharvil · Answer

It would see that something in your config is loading that extension which is why you are seeing ` Will not autoload extension with unsafe directory permissions C Program Files osquery extensions macadmins exe ` I don t think it would impact ATC though

namali · Answer

That makes sense I need to check if there is an extension or ATC that exists for windows browser history By any chance have you come across one < sharvil>

sharvil · Answer

ATC is not dependent on any extension and should work on windows too

namali · Answer

Okay Nothing in my conf points to the macadmins extensions Also I checked the extensions folder in osquery the only file within that is macadmins exe

sharvil · Answer

anything in the flagfile

namali · Answer

Where can I find the flagfile I mean the way I am running this is osqueryi config path path name atc history conf allow unsafe

sharvil · Answer

can you add ` verbose` to osqueryi and paste the whole output and also paste the conf file

namali · Answer

This is my conf file ``` auto table construction chrome history query SELECT datetime last visit time 1000000 11644473600 unixepoch as last visited url title visit count FROM urls path C Users AppData Local Google Chrome User Data History columns last visited url title visit count ```

namali · Answer

verbose output ```I1027 12 29 44 617239 3388 init cpp 357 osquery initialized version=5 2 2 I1027 12 29 44 620157 3388 extensions cpp 438 Found autoloadable extension C Program Files osquery extensions macadmins exe I1027 12 29 44 621152 3388 dispatcher cpp 78 Adding new service WatcherRunner 000001FEC25738A0 to thread 3560 000001FEC25999A0 in process 12556 I1027 12 29 44 625387 3388 dispatcher cpp 78 Adding new service ExtensionWatcher 000001FEC250E670 to thread 11268 000001FEC2599A80 in process 12556 I1027 12 29 44 625387 3388 dispatcher cpp 78 Adding new service ExtensionRunnerCore 000001FEC4419200 to thread 6224 000001FEC2599B80 in process 12556 I1027 12 29 44 626385 3388 auto constructed tables cpp 99 Removing stale ATC entries I1027 12 29 44 626385 6224 interface cpp 299 Extension manager service starting pipe shell em Using a 1mvirtual database 0m Need help type help osquery gt E1027 12 29 49 703593 3560 watcher cpp 702 Cannot create extension process C Program Files osquery extensions macadmins exe```