windows_services_md5

SCHEMA

description	string	Plugin description text
display_name	string	Service Display name
name	string	Name of the registry value entry
path	string	Full path to the value
sha1	string	SHA1 of the file now
sha256	string	SHA256 of the file now
start_type	string	Service start type

-- windows_services_md5 INFO
SELECT 
   -- Device ID DETAILS
   meta_hostname, meta_ip_address, 

   -- Query Details
   query_name, description, display_name, name, path,
   sha1, sha256, start_type,

   -- Decoration 
   meta_boot_time, meta_eid, meta_endpoint_type, 
   meta_ip_mask, meta_mac_address, meta_os_name, meta_os_platform, meta_os_type,
   meta_os_version, meta_public_ip, meta_query_pack_version, meta_username,

   --- Generic
   calendar_time, counter, epoch, host_identifier, numerics
   osquery_action, unix_time,

   -- Data Lake
   customer_id, endpoint_id, upload_size

FROM xdr_data
WHERE query_name = 'windows_services_md5'

RESULTS

Need some testing here

Karl_Ackerman