https://github.com/osquery/osquery logo
#macos
Title
# macos
c

CptOfEvilMinions

03/01/2021, 5:31 PM
Is there a way to query a list of system extensions?
z

zwass

03/01/2021, 5:32 PM
kernel_extensions
?
c

CptOfEvilMinions

03/01/2021, 5:34 PM
No, I am specifically looking for applications that are using the new Apple security framework. I found this PR: https://github.com/osquery/osquery/pull/6863
It looks like the PR was merged into MAIN but I have to wait for the next Osquery release
z

zwass

03/01/2021, 5:37 PM
Got it, looks like that PR ought to do what you're looking for.
💯 1
f

fritz

03/01/2021, 5:45 PM
@CptOfEvilMinions Because it is a plist you should be able to query it using
plist
c

CptOfEvilMinions

03/01/2021, 5:46 PM
@fritz that worked!
f

fritz

03/01/2021, 5:46 PM
👍
Happy to hear it
3 Views