search

Korving-F / DACA

DAtaset Creation Aquisition engine
MIT License
4 stars 0 forks source link

Support Windows VMs #32

Open Korving-F opened 2 years ago

Korving-F commented 2 years ago

The current jinja2 templates, Vagrant triggers and ansible/shell provisioners assume systems are Debian-based Linux systems. This should ideally be expanded so lab environments can be spun up using things like Windows workstations and/or

This would also allow for new artifacts to be collected like EVTX and ETW trace files.

Korving-F commented 2 years ago

This lack-of-support might be just limited to using Ansible (and therefore Filebeat based data export), TCPdump-based network captures and asciinema. While untested this might get closed after #31 and network capture option is added to the Vagrant templates.

For Windows guest machines that are configured to use WinRM, the shell provisioner executes PowerShell and Batch scripts over WinRM. https://www.vagrantup.com/docs/provisioning/shell

run_remote (hash) - A collection of settings to run a inline or remote script with on the guest. These settings correspond to the shell provisioner. https://www.vagrantup.com/docs/triggers/configuration