osquery-1/specs/windows/winbaseobj.table

13 lines
495 B
Plaintext
Raw Normal View History

table_name("winbaseobj")
description("Lists named Windows objects in the default object directories, across all terminal services sessions.")
schema([
2019-10-29 00:27:06 +00:00
Column("session_id", INTEGER, "Terminal Services Session Id"),
Column("object_name", TEXT, "Object Name"),
Column("object_type", TEXT, "Object Type"),
])
implementation("system/windows/Objects@genBaseNamedObjects")
examples([
"select object_name, object_type from winbaseobj",
"select * from winbaseobj where type='Mutant'",
])