diff --git a/providers/os/connection/container/image_connection_test.go b/providers/os/connection/container/image_connection_test.go
index c9e17c612b..26c093f152 100644
--- a/providers/os/connection/container/image_connection_test.go
+++ b/providers/os/connection/container/image_connection_test.go
@@ -231,11 +231,11 @@ func TestImageConnections(t *testing.T) {
 				fSearch := fs.(*tar.FS)
 
 				if test.testfile == "/etc/alpine-release" {
-					infos, err := fSearch.Find("/", regexp.MustCompile(`alpine-release`), "file")
+					infos, err := fSearch.Find("/", regexp.MustCompile(`alpine-release`), "file", nil, nil)
 					require.NoError(t, err)
 					assert.Equal(t, 1, len(infos))
 				} else if test.testfile == "/etc/centos-release" {
-					infos, err := fSearch.Find("/", regexp.MustCompile(`centos-release`), "file")
+					infos, err := fSearch.Find("/", regexp.MustCompile(`centos-release`), "file", nil, nil)
 					require.NoError(t, err)
 					assert.Equal(t, 6, len(infos))
 				}
diff --git a/providers/os/connection/tar/connection_test.go b/providers/os/connection/tar/connection_test.go
index 8b85d2aceb..b192a2733f 100644
--- a/providers/os/connection/tar/connection_test.go
+++ b/providers/os/connection/tar/connection_test.go
@@ -236,7 +236,7 @@ func TestTarFileFind(t *testing.T) {
 
 	fSearch := fs.(*tar.FS)
 
-	infos, err := fSearch.Find("/", regexp.MustCompile(`alpine-release`), "file")
+	infos, err := fSearch.Find("/", regexp.MustCompile(`alpine-release`), "file", nil, nil)
 	require.NoError(t, err)
 
 	assert.Equal(t, 1, len(infos))
diff --git a/providers/os/connection/tar/fs.go b/providers/os/connection/tar/fs.go
index 323f3ae920..14de7b058c 100644
--- a/providers/os/connection/tar/fs.go
+++ b/providers/os/connection/tar/fs.go
@@ -16,9 +16,12 @@ import (
 
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/afero"
+	"go.mondoo.com/cnquery/v11/providers/os/connection/shared"
 	"go.mondoo.com/cnquery/v11/providers/os/fsutil"
 )
 
+var _ shared.FileSearch = (*FS)(nil)
+
 func NewFs(source string) *FS {
 	return &FS{
 		Source:  source,
@@ -192,7 +195,7 @@ func (fs *FS) tar(path string, header *tar.Header) (io.ReadCloser, error) {
 
 // searches for files and returns the file info
 // regex can be nil
-func (fs *FS) Find(from string, r *regexp.Regexp, typ string) ([]string, error) {
+func (fs *FS) Find(from string, r *regexp.Regexp, typ string, perm *uint32, depth *int) ([]string, error) {
 	list := []string{}
 	for k := range fs.FileMap {
 		p := strings.HasPrefix(k, from)
@@ -200,10 +203,13 @@ func (fs *FS) Find(from string, r *regexp.Regexp, typ string) ([]string, error)
 		if r != nil {
 			m = r.MatchString(k)
 		}
+		if !depthMatch(from, k, depth) {
+			continue
+		}
 		log.Trace().Str("path", k).Str("from", from).Str("prefix", from).Bool("prefix", p).Bool("m", m).Msg("check if matches")
 		if p && m {
 			entry := fs.FileMap[k]
-			if (typ == "directory" && entry.Typeflag == tar.TypeDir) || (typ == "file" && entry.Typeflag == tar.TypeReg) {
+			if (typ == "directory" && entry.Typeflag == tar.TypeDir) || (typ == "file" && entry.Typeflag == tar.TypeReg) || typ == "" {
 				list = append(list, k)
 				log.Debug().Msg("matches")
 				continue
@@ -212,3 +218,15 @@ func (fs *FS) Find(from string, r *regexp.Regexp, typ string) ([]string, error)
 	}
 	return list, nil
 }
+
+func depthMatch(from, filepath string, depth *int) bool {
+	if depth == nil {
+		return true
+	}
+
+	trimmed := strings.TrimPrefix(filepath, from)
+	// WalkDir always uses slash for separating, ignoring the OS separator. This is why we need to replace it.
+	normalized := strings.ReplaceAll(trimmed, string(os.PathSeparator), "/")
+	fileDepth := strings.Count(normalized, "/")
+	return fileDepth <= *depth
+}
diff --git a/providers/os/fs/fs.go b/providers/os/fs/fs.go
index e9dd5891f2..41cd45a566 100644
--- a/providers/os/fs/fs.go
+++ b/providers/os/fs/fs.go
@@ -11,8 +11,11 @@ import (
 	"time"
 
 	"github.com/spf13/afero"
+	"go.mondoo.com/cnquery/v11/providers/os/connection/shared"
 )
 
+var _ shared.FileSearch = (*MountedFs)(nil)
+
 var notSupported = errors.New("not supported")
 
 type MountedFs struct {
diff --git a/providers/os/resources/files.go b/providers/os/resources/files.go
index 27ac507f21..6a5431e5a9 100644
--- a/providers/os/resources/files.go
+++ b/providers/os/resources/files.go
@@ -70,6 +70,11 @@ func (l *mqlFilesFind) list() ([]interface{}, error) {
 		if err != nil {
 			return nil, err
 		}
+	} else if len(l.Name.Data) > 0 {
+		compiledRegexp, err = regexp.Compile(l.Name.Data)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	var foundFiles []string