The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

Detecting Unauthorized file shares on hosts

Description: View and detect Unauthorized file shares.

What The Data Shows: Lists all file shares on hosts, a lot of organizations do not allow users to create shares on workstations and servers. 

SQL: 

SELECT description,status,name,path 
FROM shared_resources;

 

3 Comments
jnelson
Carbon Black Employee
Status changed to: Under Review

@mjomha can you please add a semicolon to your query?

mjomha
Contributor

Semi colon added. I was a bit confused with those still learning Osquery as it worked without. But taking a closer look it's more of a formatting and hygiene thing.

 

Thanks for noticing!

 

Moe

jnelson
Carbon Black Employee
Status changed to: Approved