Retrieves the list of recent items opened in OSX by parsing the plist per user.


Query · osquery

-- Retrieves the list of recent items opened in OSX by parsing the plist per user.
-- tags: postmortem
-- platform: darwin
select
  username,
  key,
  value
from
  plist p,
  (
    select
      *
    from
      users
    where
      directory like '/Users/%'
  ) u
where
  p.path = u.directory || '/Library/Preferences/com.apple.recentitems.plist';
Raw source Retrieves the list of recent items opened in OSX by parsing the plist per user. · osquery SQL
Esc
Published by chainguard-dev/osquery-defense-kit ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified.
-- Retrieves the list of recent items opened in OSX by parsing the plist per user.
-- tags: postmortem
-- platform: darwin
select
  username,
  key,
  value
from
  plist p,
  (
    select
      *
    from
      users
    where
      directory like '/Users/%'
  ) u
where
  p.path = u.directory || '/Library/Preferences/com.apple.recentitems.plist';

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.