Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

appcompat_shims

Application Compatibility shims are a way to persist malware. This table presents the AppCompat Shim information from the registry in a nice format. See http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more details.

Column	Type	Description
description	text	Description of the SDB.
executable	text	Name of the executable that is being shimmed. This is pulled from the registry.
install_time	integer	Install time of the SDB
path	text	This is the path to the SDB database.
sdb_id	text	Unique GUID of the SDB.
type	text	Type of the SDB database.