xprotect_entries

Database of the machine’s XProtect signatures.

Table schema

Name Type Description
name TEXT Description of XProtected malware
launch_type TEXT Launch services content type
identity TEXT XProtect identity (SHA1) of content
filename TEXT Use this file name to match
filetype TEXT Use this file type to match
optional INTEGER Match any of the identities/patterns for this XProtect name
uses_pattern INTEGER Uses a match pattern instead of identity