search

gfoss / PSRecon

:rocket: PSRecon gathers data from a remote Windows host using PowerShell (v2 or later), organizes the data into folders, hashes all extracted data, hashes PowerShell and various system properties, and sends the data off to the security team. The data can be pushed to a share, sent over email, or retained locally.
Apache License 2.0
476 stars 104 forks source link

Wrong informations on remote collection #2

Open compr00t opened 9 years ago

compr00t commented 9 years ago

if you collect the informations from a remote system, most of the data is useless because the script is reading informations from the current security context which is of course my own remote login and not the user currently logged on the infected computer. To do a good and full investigation it would be important to get informations about the user who triggered the infection...

any solution for that?

gfoss commented 9 years ago

Yeah, that's correct. You will get process and system data, but the user context will be related to whatever account you used to run the scan. I'll look into a way to possibly migrate processes or something similar to target the appropriate user. That should be doable as long as the script is run with a DA account.

Thanks! On Aug 10, 2015 6:41 AM, "compr00t" notifications@github.com wrote:

if you collect the informations from a remote system, most of the data is useless because the script is reading informations from the current security context which is of course my own remote login and not the user currently logged on the infected computer. To do a good and full investigation it would be important to get informations about the user who triggered the infection...

any solution for that?

— Reply to this email directly or view it on GitHub https://github.com/gfoss/PSRecon/issues/2.

compr00t commented 9 years ago

Any progress so far?

gfoss commented 9 years ago

Unfortunately I haven't had much time to dig into this one yet. Hope to have a resolution soon.

Mackousko12 commented 6 years ago

Hi,

Yeah I feel the same pain as target user is not other than the user script is currently running under. One way I could think of is to get the list of all active users and loop each user to collect user's data. Any thoughts?

Also some of the extracted output is not parsed into the the main html file (such as Downloads, installed softwares etc).

On a separate note note the script is still useful and I appreciate your efforts in this regards.