Open ablescia opened 1 year ago
Hi, I decided to implement the CSV fix right away by directly removing the header that was creating you problems by adding the -NoTypeInformation
parameter while calling the CSV output function. However, I need some more time to evaluate the other changes you propose as I feel like some of them significantly change how the tool works. However, in the meantime, in order to adapt the output to other formats like JSON, you could use the following hack:
Find-AllPersistence | ConvertTo-Json
Hi, I decided to implement the CSV fix right away by directly removing the header that was creating you problems by adding the
-NoTypeInformation
parameter while calling the CSV output function. However, I need some more time to evaluate the other changes you propose as I feel like some of them significantly change how the tool works. However, in the meantime, in order to adapt the output to other formats like JSON, you could use the following hack:
Find-AllPersistence | ConvertTo-Json
We can integrate the ETW interfacing function by default. In this way we could avoid modifying the tool so radically. Meanwhile, we can use the ConvertTo-Json cmdlet to implement the JSON output format as you suggest.
What do you think?
As Threat Hunter I use PersistenceSniper during my Threat Huntig and Incident Response activities. Every time I used this tool I was encouraged by the below issue:
#TYPE
tag that it is necessary to eliminate to parse correctly the file.To resolve these two issues I created a Powershell module that implements the following improvements:
#TYPE System.Management.Automation.PSCustomObject
headerBy interfacing the tool with ETW I have two advantages: