admin/matthastings-PSalander
1
0
Fork 0
mirror of https://github.com/matthastings/PSalander synced 2026-06-08 15:46:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixing demo for mac

Browse Source
This commit is contained in:
Matthew Hastings
2018-09-16 21:24:13 -04:00
parent a53fea557b
commit 1113f6e69a
1 changed files with 1 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
demo/demo.txt
+1 -8
View File
@@ -1,12 +1,5 @@
Import-Module .\PSWasp
Get-Module PSWasp | select -Expand ExportedCommands
Get-ETWProvider | select -Expand id | Group-Object | Measure-Object
Get-ETWProvider | where name -match 'kernel-process$' | select *
Get-ETWProvider | where name -match 'kernel-process$' | select -Expand Keywords
cls
Get-ETWProvider | where name -match 'kernel-process$' | select -Expand tasks
Get-ETWProvider | where name -match 'kernel-process$' | % Events | select id, description
Get-ETWSessionNames
$EmpireSession = Import-Clixml demo\demo.xml
$EmpireSession | where imagename -match "powershell" | select processid, imagename
$EmpireSession | Where ProcessID -eq 5392 | gm -MemberType NoteProperty | select Name
@@ -53,4 +46,4 @@ $MimiKaz[7].Substring(0,800)
cls
Get-ETWForensicGraph -ETWObject $EmpireSession -ParentProcessID 1924
cls
Get-ETWForensicGraph -ETWObject $EmpireSession -ParentProcessID 5392
Get-ETWForensicGraph -ETWObject $EmpireSession -ParentProcessID 5392