Can you share a similar script works with CrowdStrike RTR

MagnetForensics / Magnet-RESPONSE-PowerShell

PowerShell scripts for running Magnet RESPONSE forensic collection tool in large enterprises.

MIT License

22 stars 6 forks source link

Can you share a similar script works with CrowdStrike RTR #1

Open maltwist opened 5 months ago

maltwist commented 5 months ago

Tried few methods using CrowdStrike RTR particularly to gather Criticalsystemfiles but getting error related to user profile enumeration etc. If I run manually the tool works as expected but not with RTR. Any help would be appreciated

maltwist commented 5 months ago

Error details:

Error saving system files: System.Exception: Error enumerating user profile paths: System.NullReferenceException: Object reference not set to an instance of an object. at M6g:plg1!F>[J-2:F%NW"mA4".⁭‭‏‫‏⁫⁬‮⁭‏⁬‫⁪⁯‏‭‎‍⁯‪‫⁯⁪⁮‪⁪⁬⁫⁯‍⁭‬‏⁮‭‪⁬‮() at M6g:plg1!F>[J-2:F%NW"mA4".⁭‭‏‫‏⁫⁬‮⁭‏⁬‫⁪⁯‏‭‎‍⁯‪‫⁯⁪⁮‪⁪⁬⁫⁯‍⁭‬‏⁮‭‪⁬‮()