Channels
doorman
zercurity
infrastructure
code-review
queryhub
apple-silicon
carving
goquery
aws
querycon
golang
file-carving
fuzzing
help-proxy
darkbytes
process-auditing
general
windows
random
fleet-dev
tls
fim
awallaby
zentral
zeek
auditing-warroom
linen-dev
fleetosquery
plugins
jobs
arm-architecture
uptycs
android_tests
selfgroup
vendor-feeds
fleet
eclecticiq-polylogyx-extension
ebpf
website
core
macos
kolide
osctrl
extensions
foundation
sql
officehours
linux
community-feeds
Powered by
#macos
Title
# macos
c
CptOfEvilMinions
03/01/2021, 5:31 PM
Is there a way to query a list of system extensions?
z
zwass
03/01/2021, 5:32 PM
kernel_extensions
?
c
CptOfEvilMinions
03/01/2021, 5:34 PM
No, I am specifically looking for applications that are using the new Apple security framework. I found this PR:
https://github.com/osquery/osquery/pull/6863
It looks like the PR was merged into MAIN but I have to wait for the next Osquery release
z
zwass
03/01/2021, 5:37 PM
Got it, looks like that PR ought to do what you're looking for.
💯 1
f
fritz
03/01/2021, 5:45 PM
@CptOfEvilMinions
Because it is a plist you should be able to query it using
plist
c
CptOfEvilMinions
03/01/2021, 5:46 PM
@fritz
that worked!
f
fritz
03/01/2021, 5:46 PM
👍
Happy to hear it
3 Views
Post