davehull / Kansa

A Powershell incident response framework
Apache License 2.0
1.56k stars 266 forks source link

Possible Typo in Modules/Log/Get-AppCompatCache.ps1 #184

Open cduram opened 6 years ago

cduram commented 6 years ago

I was having trouble getting this to run. After switching from -tsv to -csv it began working properly:

C:\Users\\Desktop\Kansa-master\Kansa-master\Modules\Log\Get-AppCompatCache - Original.ps1 : AppCompatCacheParser.exe not found on CSC-DURAM-VM2 At line:1 char:1

  • & '.\Get-AppCompatCache - Original.ps1'
  • 
    + CategoryInfo          : NotSpecified: (:) [Write-Error], WriteErrorException
    + FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Get->AppCompatCache - Original.ps1

`<# .SYNOPSIS Get-AppCompatCache.ps1 When run via Kansa.ps1 with -Pushbin flag, this module will copy AppCompatCacheParser.exe to the remote system, then run AppCompatCacheParser.exe --csv $AppCompatCacheParserOutputPath on the remote system, and return the output data as a powershell object.

AppCompatCacheParser.exe can be downloaded from http://ericzimmerman.github.io/

.NOTES Kansa.ps1 directives OUTPUT CSV BINDEP .\Modules\bin\AppCompatCacheParser.exe

>

Setup Variables

$AppCompatCacheParserPath = ($env:SystemRoot + "\AppCompatCacheParser.exe") $Runtime = ([String] (Get-Date -Format yyyyMMddHHmmss)) $suppress = New-Item -Name "ACCP-$($Runtime)" -ItemType Directory -Path $env:Temp -Force $AppCompatCacheParserOutputPath = $($env:Temp + "\ACCP-$($Runtime)")

if (Test-Path ($AppCompatCacheParserPath)) {

Run AppCompatCacheParser.exe

$suppress = & $AppCompatCacheParserPath --csv $AppCompatCacheParserOutputPath
#Output the data.
Import-Csv -Delimiter "`t" "**$AppCompatCacheParserOutputPath\*.csv"**

#Delete the output folder.
$suppress = Remove-Item $AppCompatCacheParserOutputPath -Force -Recurse

} else { Write-Error "AppCompatCacheParser.exe not found on $env:COMPUTERNAME" }`