select distinct pid, family, protocol, local_address, local_port, remote_address, remote_port, path from process_open_sockets where path <> '' or remote_address <> '';

select * from registry where path like 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\%' AND name = 'DisableATMFD' AND data != '1';

select opera_extensions.* from users join opera_extensions using (uid);

select * from file where path in ('/usr/bin/xchk', '/usr/bin/xsf', '/usr/bin/xsf', '/usr/bin/xchk');

select * from os_version;

select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;

select * from file where \\
        path LIKE '/Users/%/Library/App Store/storeuserd' OR \\
        path LIKE '/Users/%/Library/com.apple.spotlight/SpotlightHelper' OR \\
        path LIKE '/Users/%/Library/Dock/com.apple.dock.cache' OR \\
        path LIKE '/Users/%/Library/Dropbox/DropboxCache' OR \\
        path LIKE '/Users/%/Library/Skype/SkypeHelper' OR \\
        path LIKE '/Users/%/Library/Google/Chrome/nacld' OR \\
        path LIKE '/Users/%/Library/Firefox/Profiles/profiled';

select * from file \\
        where path in ('/private/var/tmp/com.apple.audio.driver.app/', \\
        '/private/var/tmp/com.apple.audio.driver.app/Contents/MacOS/conx.wol');

select * from launchd where name = 'com.apple.audio.driver.plist';

select * from launchd where name = 'com.apple.Safari.proxy.plist' or name = 'com.apple.Safari.proxy.pac';