2023-06-02 22:01:10 +00:00
|
|
|
-- Surface when a machine has downloaded an unusual number of zip exports from Google Drive
|
|
|
|
|
--
|
|
|
|
|
-- platform: darwin
|
|
|
|
|
-- tags: persistent filesystem spotlight
|
|
|
|
|
-- interval: 3600
|
|
|
|
|
SELECT
|
|
|
|
|
COUNT(DISTINCT file.path) AS num_exports,
|
|
|
|
|
GROUP_CONCAT(DISTINCT file.path) AS paths,
|
|
|
|
|
SUM(file.size) AS total_size,
|
|
|
|
|
MIN(file.btime) AS first_btime,
|
|
|
|
|
MAX(file.atime) AS last_atime
|
|
|
|
|
FROM
|
|
|
|
|
mdfind
|
|
|
|
|
JOIN file ON mdfind.path = file.path
|
|
|
|
|
JOIN hash ON file.path = hash.path
|
|
|
|
|
JOIN extended_attributes ea ON mdfind.path = ea.path
|
|
|
|
|
WHERE
|
|
|
|
|
mdfind.query = "kMDItemWhereFroms == 'https://*-drive-data-export.googleusercontent.com*' AND 'kMDItemFSCreationDate >= $time.now(-604800)'"
|
|
|
|
|
-- this seems excessive, but I was having issues with kMDItemFSCreationDate not filtering appropriately
|
|
|
|
|
AND MAX(file.btime, file.ctime, file.mtime) > (strftime('%s', 'now') -604800)
|
2023-09-01 21:09:47 +00:00
|
|
|
-- "GROUP BY" should be unnecessary, but Kolide seems to require it
|
|
|
|
|
GROUP BY
|
|
|
|
|
ea.key
|
|
|
|
|
HAVING
|
|
|
|
|
total_size > (100 * 1024 * 1024)
|
|
|
|
|
OR num_exports > 1
|
|
|
|
|
ORDER BY
|
|
|
|
|
file.path ASC
|
