https://github.com/osquery/osquery logo
#macos
Title
a

allister

03/03/2023, 2:51 PM
an 'app' is just a bundle of stuff, right? You may not be able to be comprehensive to determine what launched from all the possible associated code inside an app, but there's a long-standing example query about finding processes and JOINing on the path from the app table
5 Views