mark-hallman

Here are a few RECmd barch file exmaples.

mark-hallman

Example of using new --tvars cli option in the just released KAPE 0.9.0.0.  

kape --tsource f:\C\ --tdest g:\tmp\kape_out\tdest --target EventLogs --tvars eventlog:OAlerts  --tflush

Gets you the single OAlerts.evtx event log

kape --tsource f:\C\ --tdest g:\tmp\kape_out\tdest --target EventLogs  --tflush

Gets you all event logs just like the the old target produced.

mark-hallman

Get-Item -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\"  | New-ItemProperty -Name DisableAntiSpyware -Value 1

mark-hallman

Get-Item -Path "HKLM:\Software\Policies\Microsoft\Windows Defender\"  | New-ItemProperty -Name DisableAntiSpyware -Value 1

mark-hallman

<#
.DESCRIPTION
   This script is to facilitate processing only relevant event logs with EvtxECmd.  EvtxECmd can
   only process one file at a time with the "-f" switch or a directory of event logs with 
   the "-d" switch.  An example list of relevant event logs are contained in the EntLogs2Process.txt file.  
   The initial list include the event logs discussed in SANS FOR508.  Once the event logs are copied to the
   directory you provide on the cli,  the script will process the event logs with EvtxECmd using the "-inc"
   option to process only the event_ids provided in the $event_id variable.  This variable is initially
   populated with the event_ids dicussed in SANS FOR508.

mark-hallman

APPLICATION.evtx 
Microsoft-Windows-PowerShell%4Operational.evtx
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Admin.evtx 
Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx 
Microsoft-Windows-SmbClient%4Security.evtx 
Microsoft-Windows-TaskScheduler%4Maintenance.evtx 
Microsoft-Windows-TaskScheduler%4Operational.evtx 
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx 
Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx 
Microsoft-Windows-WinRM%4Operational.evtx 

mark-hallman

# Set network to private
Get-NetConnectionProfile
Set-NetConnectionProfile -InterfaceIndex <index number> -NetworkCategory Private

# To Turn Off Firewall & AV: 
NetSh Advfirewall set allprofiles state off

#Enabling PowerShell Remoting
Enable-PSRemoting -SkipNetworkProfileCheck -Force
Test-WSMan -ComputerName SRV1

mark-hallman

##############################
# Script from Jerod Alexander to update /kape/module/bin files
##############################
@echo off
cd "C:\Forensic Program Files\Zimmerman"
powershell .\Get-ZimmermanTools.ps1
cd C:\KAPE
powershell .\Get-KAPEUpdate.ps1
kape.exe --sync
robocopy "C:\Forensic Program Files\" C:\KAPE\Modules\bin *.exe /v /copy:dat /w:1 /r:1

mark-hallman

	##############################
	# Script from Jerod Alexander to update /kape/module/bin files
	##############################
	@echo off
	cd "C:\Forensic Program Files\Zimmerman"
	powershell .\Get-ZimmermanTools.ps1
	cd C:\KAPE
	powershell .\Get-KAPEUpdate.ps1
	kape.exe --sync
	robocopy "C:\Forensic Program Files\" C:\KAPE\Modules\bin *.exe /v /copy:dat /w:1 /r:1

mark-hallman

# Please check https://github.com/cvandeplas/ELK-forensics for more information.
# Created by Christophe Vandeplas <christophe@vandeplas.com>

# Import a mactime output file to your Elasticsearch database.
#
# Do note that Plaso can export directly to Elasticsearch.
# Have a look at the plaso.conf file in this repository.
#
# To generate the mactime file using the CSV output:
# - first generate the dump file with 'log2timeline.py' from Plaso