osquery-defense-kit/incident_response/known_hosts.sql

7 lines
191 B
MySQL
Raw Normal View History

2023-02-23 14:35:38 +00:00
-- Retrieves chrome extensions that execute on a broad set of URLs.
-- tags: postmortem
-- platform: posix
SELECT known_hosts.*
FROM users
JOIN known_hosts ON users.uid = known_hosts.uid