osquery-defense-kit/incident_response/files-etc.sql

8 lines
197 B
MySQL
Raw Normal View History

2023-02-23 14:35:38 +00:00
-- Returns a list of file information from /etc (non-hidden only)
--
-- tags: postmortem
-- platform: posix
SELECT *
FROM file
JOIN hash ON file.path = hash.path
WHERE file.path LIKE "/etc/%%";