mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-06 09:35:20 +00:00
19 lines
775 B
Plaintext
19 lines
775 B
Plaintext
table_name("startup_items")
|
|
description("Applications and binaries set as user/login startup items.")
|
|
schema([
|
|
Column("name", TEXT, "Name of startup item"),
|
|
Column("path", TEXT, "Path of startup item"),
|
|
Column("args", TEXT, "Arguments provided to startup executable"),
|
|
Column("type", TEXT, "Startup Item or Login Item"),
|
|
Column("source", TEXT, "Directory or plist containing startup item"),
|
|
Column("status", TEXT, "Startup status; either enabled or disabled"),
|
|
Column("username", TEXT, "The user associated with the startup item"),
|
|
])
|
|
attributes(cacheable=True)
|
|
implementation("startup_items@genStartupItems")
|
|
fuzz_paths([
|
|
"/System/Library/StartupItems/",
|
|
"/Library/StartupItems/",
|
|
"/Library/Preferences/com.apple.loginitems.plist"
|
|
])
|