# Title: Interesting Files - DB files
# ID: IF_Macos_downloaded_files
# Author: Carlos Polop
# Last Update: 22-08-2023
# Description: Check which files have been downloaded
# License: GNU GPL
# Version: 1.0 
# Mitre: T1005
# Functions Used: print_2title
# Global Variables: $MACPEAS
# Initial Functions:
# Generated Global Variables:
# Fat linpeas: 0
# Small linpeas: 0


if [ "$MACPEAS" ]; then
  print_2title "Downloaded Files" "T1005"
  sqlite3 ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2 'select LSQuarantineAgentName, LSQuarantineDataURLString, LSQuarantineOriginURLString, date(LSQuarantineTimeStamp + 978307200, "unixepoch") as downloadedDate from LSQuarantineEvent order by LSQuarantineTimeStamp' | sort | grep -Ev "\|\|\|"
fi