Moved antivirusproduct to situational_awareness/host/antivirusproduct ,

added ComputerName option, output pipeline fix.
1.6
Harmj0y 2015-10-30 13:39:25 -04:00
parent 59aa123d88
commit 581c9aa948
1 changed files with 13 additions and 5 deletions

View File

@ -9,9 +9,9 @@ class Module:
'Author': ['@mh4x0f', 'Jan Egil Ring'],
'Description': ('get antivirus product information.'),
'Description': ('Get antivirus product information.'),
'Background' : False,
'Background' : True,
'OutputExtension' : None,
@ -34,6 +34,11 @@ class Module:
'Description' : 'Agent to run module on.',
'Required' : True,
'Value' : ''
},
'ComputerName' : {
'Description' : 'Computername to run the module on, defaults to localhost.',
'Required' : True,
'Value' : ''
}
}
@ -56,9 +61,9 @@ function Get-AntiVirusProduct {
param (
[parameter(ValueFromPipeline=$true, ValueFromPipelineByPropertyName=$true)]
[Alias('name')]
$computername=$env:computername )
$ComputerName=$env:computername )
$Query = 'select * from AntiVirusProduct'
$AntivirusProduct = Get-WmiObject -Namespace 'root\SecurityCenter2' -Query $Query @psboundparameters # -ErrorVariable myError -ErrorAction 'SilentlyContinue'
$AntivirusProduct = Get-WmiObject -Namespace 'root\SecurityCenter2' -Query $Query @psboundparameters -ErrorVariable myError -ErrorAction 'SilentlyContinue'
switch ($AntiVirusProduct.productState) {
'262144' {$defstatus = 'Up to date' ;$rtstatus = 'Disabled'}
'262160' {$defstatus = 'Out of date' ;$rtstatus = 'Disabled'}
@ -73,13 +78,14 @@ function Get-AntiVirusProduct {
default {$defstatus = 'Unknown' ;$rtstatus = 'Unknown'}
}
$ht = @{}
$ht.Computername = $computername
$ht.Computername = $ComputerName
$ht.Name = $AntiVirusProduct.displayName
$ht.ProductExecutable = $AntiVirusProduct.pathToSignedProductExe
$ht.'Definition Status' = $defstatus
$ht.'Real-time Protection Status' = $rtstatus
New-Object -TypeName PSObject -Property $ht
}
Get-AntiVirusProduct """
for option,values in self.options.iteritems():
@ -91,4 +97,6 @@ Get-AntiVirusProduct """
else:
script += " -" + str(option) + " " + str(values['Value'])
script += ' | Out-String | %{$_ + \"`n\"};"`n'+str(self.info["Name"])+' completed!";'
return script