Chainbreaker
Query
DeviceFileEvents
| where FolderPath contains @"/private/var/db/SystemKey"About this query
Tags:
Query:
Explanation
The query is searching for events related to device files. It filters the results to only include events where the folder path contains "/private/var/db/SystemKey".