return full path
Opened this issue · 0 comments
lprat commented
Hi,
Thanks for you work!
I would like extract full path on query.
With jq , i can do:
$ cat report-cuckoo.json |jq 'path(.. |.file_written?| select(.!=null))'
[
"behavior",
"generic",
1,
"summary",
"file_written"
]
[
"behavior",
"summary",
"file_written"
]
Is it possible with your tool?
Loading JSON document from report-cuckoo.json... done.
$..*[@.file_written]
[
[
"C:\Users\cuck\AppData\LocaldsDwSUeGcL.exe",
"C:\Users\cuck\AppData\LocalMgyoNizMqk.jpg"
],
[
"C:\Users\cuck\AppData\LocaldsDwSUeGcL.exe",
"C:\Users\cuck\AppData\LocalMgyoNizMqk.jpg"
]
]
I don't found solution.
Thanks for help.
Sincerly,
Lionel