infosecn1nja
/
AggressorScripts
mirror of https://github.com/infosecn1nja/AggressorScripts.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added a barch check for correct directories

master
Harley Lebeau 2018-08-17 12:27:50 -06:00 committed by GitHub
parent 1ec0f610d4
commit 0ad8289152
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
EDR.cna
View File

@ -5,13 +5,20 @@
#EDR_Query Command Register
beacon_command_register("EDR_Query", "Queries the System for all major EDR products installed",
"Syntax: EDR_Query\n" .
"Checks C:\\Windows\\System32\\drivers for installed EDR products");
"Syntax: EDR_Query\n" .
"Checks C:\\Windows\\System32\\drivers for installed EDR products");
#EDR_Query alias
alias EDR_Query {
blog($1, "\cBDetermining what EDR products are installed...");
bls($1, "c:\\windows\\sysnative\\drivers", &list);
$bd = bdata($1);
if ($bd['barch'] eq "x64") {
blog($1, "\cBDetermining what EDR products are installed...");
bls($1, "C:\\windows\\System32\\drivers", &list);
}
else {
blog($1, "\cBDetermining what EDR products are installed...");
bls($1, "C:\\windows\\sysnative\\drivers", &list);
}
}
#Parse dem results