OSX DOK 2
select common_name, sha1, subject_key_id from certificates where subject_key_id = 'e637d656f9f088ddca3b3b55c4fe698d8c97a552';View Full Query Details
select common_name, sha1, subject_key_id from certificates where subject_key_id = 'e637d656f9f088ddca3b3b55c4fe698d8c97a552';View Full Query Details
select * from file where path = '/Users/Shared/AppStore.app';View Full Query Details
select * from apps where bundle_name = 'Truesteer.AppStore';View Full Query Details
SELECT * FROM file \\
WHERE path = '/Library/LaunchDaemons/com.startup.plist' OR \\
path = '/var/root/script.sh' OR \\
path = '/Users/Shared/dumpdummy' OR \\
path = '/tmp/script.sh' OR \\
path = '/tmp/com.startup.plist' OR \\
path = '/tmp/dumpdummy';View Full Query DetailsSELECT * FROM launchd WHERE name = 'com.startup.plist';View Full Query Details
select * from launchd where name = 'com.client.client.plist';View Full Query Details
select * from launchd where name = 'com.apple.hidd.shared.plist';View Full Query Details
select * from launchd where name IN ('com.apple.iCloud.sync.daemon', 'com.geticloud.icloud.photo');View Full Query Detailsselect * from file where path = '/Users/Shared/.local/kext' or path = '/Users/Shared/com.apple.updates.plist' or path = '/Users/Shared/start.sh';View Full Query Details
select * from certificates where common_name like '%cloudguard.me%' and not_valid_after = '2352216315';View Full Query Details