https://github.com/osquery/osquery logo
#sql
Title
# sql
z

zwass

03/30/2018, 3:00 AM
@clong I'm not really sure how you would get a python process into that state to test it, but I think it would look something like
Copy code
SELECT p.* FROM processes p LEFT JOIN process_open_files pof USING (pid) WHERE cmdline LIKE '%python%' AND name = "Python" AND pof.path = '';
c

clong

03/30/2018, 8:04 PM
Thanks! I got it working with the help of this query — really appreciate it!
🍻 1
6 Views