Adding ASEP collector Get-AutorunscDeep.ps1

davehull / Kansa

A Powershell incident response framework

Apache License 2.0

1.56k stars 266 forks source link

Adding ASEP collector Get-AutorunscDeep.ps1 #80

Closed davehull closed 9 years ago

davehull commented 9 years ago

For interpreted ASEPS (i.e. .bat, .ps1 and .vbs scripts), Get-AutorunscDeep.ps1 will attempt to collect an MD5 hash of the actual script itself. Autoruns alone only collects the hash of the interpreter.