fritz
07/13/2021, 4:30 PMuuid
's generated by the system will start with a known set of characters, eg. FFFFEEE
For example on my test device:
osquery> SELECT SUBSTR(uuid,1,16), COUNT(SUBSTR(uuid,1,16)) FROM users GROUP BY SUBSTR(uuid,1,16);
+-------------------+--------------------------+
| SUBSTR(uuid,1,16) | COUNT(SUBSTR(uuid,1,16)) |
+-------------------+--------------------------+
| 425D5A4B-8EF2-4E | 1 |
| 595A9274-B7F3-43 | 1 |
| 76057753-404D-41 | 1 |
| E96D1341-6627-4E | 1 |
| FFFFEEEE-DDDD-CC | 112 |
+-------------------+--------------------------+
Utsav Shah
07/13/2021, 4:38 PM