Is there a way to query a list of system extension...
# macosc
CptOfEvilMinions
03/01/2021, 5:31 PMIs there a way to query a list of system extensions?
z
zwass
03/01/2021, 5:32 PM
kernel_extensionsc
CptOfEvilMinions
03/01/2021, 5:34 PMNo, I am specifically looking for applications that are using the new Apple security framework.
I found this PR: https://github.com/osquery/osquery/pull/6863
CptOfEvilMinions
03/01/2021, 5:35 PMIt looks like the PR was merged into MAIN but I have to wait for the next Osquery release
z
zwass
03/01/2021, 5:37 PM
Got it, looks like that PR ought to do what you're looking for.
💯 1
f
fritz
03/01/2021, 5:45 PM@CptOfEvilMinions Because it is a plist you should be able to query it using
plistc
CptOfEvilMinions
03/01/2021, 5:46 PM@fritz that worked!
f
fritz
03/01/2021, 5:46 PM👍
fritz
03/01/2021, 5:46 PMHappy to hear it
5 Views