Get user files matching a specific hash
Get user files matching a specific hash
Looks for specific hash in the Users/ directories for files that are less than 50MB (osquery file size limitation.)
To learn more about queries, check this guide
SELECT path, sha256 FROM hash WHERE path IN (SELECT path FROM file WHERE size < 50000000 AND path LIKE '/Users/%/Documents/%%') AND sha256 = '16d28cd1d78b823c4f961a6da78d67a8975d66cde68581798778ed1f98a56d75';
PowerShell commands are currently work in progress, contributions welcome.
Platform
Edit
SOC2 Type 2
© 2025 Fleet Inc.
Privacy
