Shouldn’t it be possible to select a files in a folder and its subfolders with the query in OSQuery:
SELECT path FROM file WHERE directory LIKE '/Users/%';
SELECT path FROM file WHERE path LIKE '/Users/%%';
But be warned that this is going to do a traversal of the entire filesystem below /Users, so it's going to take a while to run and return a huge number of results.
You could achieve this with
But be warned that this is going to do a traversal of the entire filesystem below
/Users
, so it's going to take a while to run and return a huge number of results.