KAPE Target Vatiables --tvars

kape_tvars.txt

Example of using new --tvars cli option in the just released KAPE 0.9.0.0.  

kape --tsource f:\C\ --tdest g:\tmp\kape_out\tdest --target EventLogs --tvars eventlog:OAlerts  --tflush

Gets you the single OAlerts.evtx event log

kape --tsource f:\C\ --tdest g:\tmp\kape_out\tdest --target EventLogs  --tflush

Gets you all event logs just like the the old target produced.

The updated EventLogs.tkape target file looks like this:


Description: Event logs
Author: Eric Zimmerman / Mark Hallman
Version: 2
Id: d95784d9-bd1c-472b-aeef-de5d9ecc7aaa
RecreateDirectories: true
Targets:
    -
        Name: Event logs XP
        Category: EventLogs
        Path: C:\Windows\system32\config\%eventlog%.evt
        IsDirectory: false
        Recursive: false
        Comment: ""
    -
        Name: Event logs Win7+
        Category: EventLogs
        Path: C:\Windows*\system32\winevt\logs\%eventlog%.evtx
        IsDirectory: false
        Recursive: false
        Comment: ""
 
I'll post this target to GitHub.  Looking for other targets that can make use of this new feature. Let me know if you have any in mind.  I'll post here when I have others.  Eric has updated all the the targets that have a username in the path.