Chainbreaker
Query
Tags:
Query:
DeviceFileEvents
| where FolderPath contains @"/private/var/db/SystemKey"Explanation
The query is searching for events related to device files. It filters the results to only include events where the folder path contains "/private/var/db/SystemKey".
Details
Ali Hussein
Released: October 26, 2023
Tables
DeviceFileEvents
Keywords
DeviceFileEventsFolderPath
Operators
| where EventID == 4656
| where EventData contains "File Write"
| project TimeGeneratedComputerEventDataFolderPath