Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

wmi_script_event_consumers

WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.

Column	Type	Description
class	text	The name of the class.
name	text	Unique identifier for the event consumer.
relative_path	text	Relative path to the class or instance.
script_file_name	text	Name of the file from which the script text is read, intended as an alternative to specifying the text of the script in the ScriptText property.
script_text	text	Text of the script that is expressed in a language known to the scripting engine. This property must be NULL if the ScriptFileName property is not NULL.
scripting_engine	text	Name of the scripting engine to use, for example, 'VBScript'. This property cannot be NULL.

Example

select filter,consumer,query,scripting_engine,script_file_name,script_text,wsec.name from wmi_script_event_consumers wsec left outer join wmi_filter_consumer_binding wcb on consumer = wsec.relative_path left outer join wmi_event_filters wef on wef.relative_path = wcb.filter;

Edit page