PowerShell Remoting

Details

ID	`PowerShell Remoting`
Provider	Microsoft
Category	Utilities
From Version	6.0.0
Docker Image	`demisto/powershell-ubuntu:7.5.0.10049856`
Supported Modules	Agentix XSIAM

README

PowerShell Remoting is a comprehensive built-in remoting subsystem that is a part of Microsoft’s native Windows management framework (WMF) and Windows remote management (WinRM).
This feature allows you to handle most remoting tasks in any configuration you might encounter by creating a remote PowerShell session to Windows hosts and executing commands in the created session.
The integration includes out-of-the-box commands which supports agentless forensics for remote hosts.

For more information about setting up PowerShell Remoting, see the PowerShell Remoting - Configuration guide.

Configure PowerShell Remoting in Cortex

Parameter	Description	Required
Domain	Fully Qualified Domain Name suffix to be added to the hostname. For example mydomain.local	False
DNS	The IP address of the DNS server the integration will use to resolve your hosts.	False
Username	Username in the target machine. This can be a local or domain user with administrative privileges	True
Password		True
Test Host	Hostname or IP address to use as a test for the integration connectivity.	False
Authentication Method		True
Trust any certificate (not secure)		False
Use SSL (HTTPS)		False

Configuration Notes

Please note that in order for the integration to function properly, Basic Authentication is required to be enabled for the target host. This is due to the library relying on Basic Auth headers to pass an authentication token even when MFA is enabled.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ps-remote-command

Executes remote PowerShell commands on a single host.

Base Command

ps-remote-command

Input

Argument Name	Description	Required
host	A single hostname or IP address on which to run the command.	Required
command	PowerShell commands (can be single or multiple in order of execution) to run on the target machine.	Required

Context Output

Path	Type	Description
PsRemote.Host	string	The host on which the command was invoked.
PsRemote.FQDN	string	The Fully Qualified Domain Name of the host on which the command was invoked.
PsRemote.CommandResult	list	The result of the command run from the target machine.
PsRemote.CommandName	string	The command sent to the target machine, used as an ID of that query.
PsRemote.UTCTime	string	Time the command finished execution in UTC time.

Command Example

!ps-remote-command host=XSOAR-XSOAR command=whoami

Context Example

{
    "PsRemote": {
        "UTCTime": "2021-07-18T15:46:07.2006094+00:00", 
        "FQDN": "XSOAR-XSOAR.winrm.local", 
        "Host": "XSOAR-XSOAR", 
        "CommandName": "whoami", 
        "CommandResult": [
            "winrm\\administrator\n"
        ]
    }
}

Human Readable Output

Result for PowerShell Remote Command: whoami
winrm\administrator

ps-remote-download-file

Downloads a file from the remote endpoint.

Base Command

ps-remote-download-file

Input

Argument Name	Description	Required
host	Hostname or the IP address on which to run the command.	Required
path	The path of the file to download.	Required
zip_file	Whether to compress the file. Possible values: “true” and “false”. Default is “false”. Possible values are: true, false. Default is false.	Optional
check_hash	Whether to compare the value of the original file with the downloaded file and return an error if any differences are found. Possible values: “true” and “false”. Default is “false”. Possible values are: true, false. Default is false.	Optional
host_prefix	Whether to use the host as a prefix for the name of the downloaded version of the file. Possible values: “true” and “false”. Default is “false”. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
PsRemoteDownloadedFile.Host	string	The host from which the file was downloaded.
PsRemoteDownloadedFile.FQDN	string	The Fully Qualified Domain Name of the host from which the file was downloaded.
PsRemoteDownloadedFile.FileName	String	File name.
PsRemoteDownloadedFile.FileSize	Number	File size.
PsRemoteDownloadedFile.FileMD5	String	The MD5 hash of the file.
PsRemoteDownloadedFile.FileSHA1	String	The SHA1 hash of the file.
PsRemoteDownloadedFile.FileSHA256	String	The SHA256 hash of the file.
PsRemoteDownloadedFile.FileExtension	String	The extension of the file.
File.Size	Number	The size of the file in bytes.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.SHA512	String	The SHA512 hash of the file.
File.Name	String	The full file name.
File.SSDeep	String	The ssdeep hash of the file.
File.EntryID	String	The ID for locating the file in the War Room.
File.Info	String	The file information.
File.Type	String	The file type.
File.MD5	String	The MD5 hash of the file.
File.Extension	String	The file extension, for example: “txt”.

Command Example

!ps-remote-download-file host="XSOAR-XSOAR" path="c:\\XSOAR-XSOAR.etl" zip_file="true" check_hash="true" host_prefix="true"

ps-remote-upload-file

Uploads a file to the remote endpoint.

Base Command

ps-remote-upload-file

Input

Argument Name	Description	Required
host	A single hostname or IP address on which to run the command.	Required
path	The path of the file to upload.	Required
entry_id	The file entry ID to upload.	Required
zip_file	Whether to compress the file before upload. Possible values: “true” and “false”. Default is “false”. Possible values are: true, false. Default is false.	Optional
check_hash	Whether to compare the values of the original file and uploaded file and return an error if any differences are found. Possible values: “true” and “false”. Default is “false”. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
PsRemoteUploadedFile.FileName	String	File name.
PsRemoteUploadedFile.FilePath	String	File path in the remote server.
PsRemoteUploadedFile.FileSize	Number	File size.
PsRemoteUploadedFile.FileMD5	String	The MD5 hash of the file.
PsRemoteUploadedFile.FileSHA1	String	The SHA1 hash of the file.
PsRemoteUploadedFile.FileSHA256	String	The SHA256 hash of the file.
PsRemoteUploadedFile.FileExtension	String	The extension of the file.
PsRemoteUploadedFile.Host	string	The host to which the file was uploaded.
PsRemote.FQDN	string	The Fully Qualified Domain Name of the host the file was uploaded to.

Command Example

!ps-remote-upload-file entry_id=105@1d0796aa-dde9-4f18-8f04-bbe92434ba81 host="XSOAR-XSOAR" path="c:\\tmpetl.etl"

Human Readable Output

File 1d0796aa-dde9-4f18-8f04-bbe92434ba81_105@1d0796aa-dde9-4f18-8f04-bbe92434ba81 was uploaded successfully as: c:\tmpetl.etl

ps-remote-etl-create-start

This command starts the recording of an ETL file on a Windows endpoint. An ETL file is just like a PCAP file which is created by the Windows Netsh command.

Base Command

ps-remote-etl-create-start

Input

Argument Name	Description	Required
host	A single hostname or IP address on which to run the command.	Required
etl_path	The path on the hostname on which to create the ETL file. For example c:\temp\myhost.etl. Default is “C:\Users\<username>\AppData\Local\Temp\NetTraces\NetTrace.etl”.	Required
etl_filter	The filter to apply when creating the ETL file. For example IPv4.Address=1.1.1.1 to capture traffic just from the 1.1.1.1 IP address. If no filter is specified all traffic will be recorded. For more examples, see: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj129382(v=ws.11)#using-filters-to-limit-etl-trace-file-details.	Optional
etl_max_size	The maximum file size for the ETL. Once the file has reached this size, the capture will stop. For example 10MB. The default size is 10MB. Default is 10.	Optional
overwrite	Whether to overwrite the file in the path. Possible values: “yes” and “no”. Default is “no”. Possible values are: yes, no. Default is no.	Optional

Context Output

Path	Type	Description
PsRemote.CommandResult	string	The start ETL command results.
PsRemote.EtlFileName	string	The name of the ETL file.
PsRemote.EtlFilePath	unknown	The path and name of the ETL file.
PsRemote.CommandName	string	The name of the command that ran on the host.
PsRemote.FQDN	string	The Full Qualified Domain Name of the host.
PsRemote.Host	string	The name of the host.

Command Example

!ps-remote-etl-create-stop host="XSOAR-XSOAR"

Human Readable Output

Trace configuration: ——————————————————————- Status: Running Trace File: C:\XSOAR-XSOAR__a.etl Append: Off Circular: On Max Size: 10 MB Report: Off

Context Example

{
    "PsRemote": {
        "CommandResult": [
            "Trace configuration:\n", 
            "-------------------------------------------------------------------\n", 
            "Status:             Running\n", 
            "Trace File:         C:\\XSOAR-XSOAR__a.etl\n", 
            "Append:             Off\n", 
            "Circular:           On\n", 
            "Max Size:           10 MB\n", 
            "Report:             Off\n"
        ], 
        "FQDN": "XSOAR-XSOAR.winrm.local", 
        "EtlFilePath": "c:\\XSOAR-XSOAR__a.etl", 
        "UTCTime": "2021-07-18T15:58:08.2528721+00:00", 
        "Host": "XSOAR-XSOAR", 
        "CommandName": "netsh trace start capture=yes traceFile=c:\\XSOAR-XSOAR__a.etl maxsize=10 overwrite=no ", 
        "EtlFileName": "XSOAR-XSOAR__a.etl"
    }
}

ps-remote-etl-create-stop

Ends the recording of an ETL file on a Windows endpoint.

Base Command

ps-remote-etl-create-stop

Input

Argument Name	Description	Required
host	A single Hostname or IP address on which to run the command.	Required

Context Output

Path	Type	Description
PsRemote.CommandResult	string	The stop ETL command results.
PsRemote.CommandName	string	The name of the command that ran on the host.
PsRemote.EtlFileName	string	The name of the ETL file.
PsRemote.EtlFilePath	unknown	The path and name of the ETL file.
PsRemote.Host	string	The host the command was invoked on.
PsRemote.FQDN	string	The Fully Qualified Domain Name of the host on which the command was invoked.

Command Example

!ps-remote-etl-create-stop host="XSOAR-XSOAR"

Human Readable Output

Correlating traces … done Merging traces … done Generating data collection … done The trace file and additional troubleshooting information have been compiled as “c:\XSOAR-XSOAR__a.cab”. File location = c:\XSOAR-XSOAR__a.etl Tracing session was successfully stopped.

Context Example

{
    "PsRemote": {
        "CommandResult": "Correlating traces ... done Merging traces ... done Generating data collection ... done The trace file and additional troubleshooting information have been compiled as \"c:\\XSOAR-XSOAR__a.cab\". File location = c:\\XSOAR-XSOAR__a.etl Tracing session was successfully stopped. ", 
        "FQDN": "XSOAR-XSOAR.winrm.local", 
        "EtlFilePath": "c:\\XSOAR-XSOAR__a.etl", 
        "Host": "XSOAR-XSOAR", 
        "CommandName": "netsh trace stop", 
        "EtlFileName": "XSOAR-XSOAR__a.etl"
    }
}

ps-remote-export-registry

Exports the specified registry of hive to a file.

Base Command

ps-remote-export-registry

Input

Argument Name	Description	Required
host	A single hostname or IP address on which to run the command.	Required
reg_key_hive	The registry key or hive to export. For example, reg_key_hive=`HKEY_LOCAL_MACHINE`. If the user specifies “all”, the entire registry will be exported. Default is “all”. Default is all.	Optional
file_path	The path and name on the Windows host where the registry file will be created. For example, file_path=c:\hklm.reg.	Required

Context Output

Path	Type	Description
PsRemote.CommandResult	string	The command results in the remote host - regedit for all or reg export.
PsRemote.RegistryFilePath	string	The path and name of the registry file.
PsRemote.RegistryFileName	string	The name of the registry file.
PsRemote.Command.Name	string	The name of the command that ran on the host.
PsRemote.Fqdn	string	The Full Qualified Domain Name of the host.
PsRemote.Host	string	The host on which the command was invoked.
PsRemote.FQDN	string	The Fully Qualified Domain Name of the host on which the command was invoked.

Command Example

!ps-remote-export-registry host="XSOAR-XSOAR" file_path="c:\\XSOAR-XSOAR__a.reg"

Human Readable Output

Ran Export Registry.
Registry file expected path: c:\XSOAR-XSOAR__a.reg

Context Example

{
    "PsRemote": {
        "RegistryFileName": "XSOAR-XSOAR__a.reg", 
        "RegistryFilePath": "c:\\XSOAR-XSOAR__a.reg", 
        "FQDN": "XSOAR-XSOAR.winrm.local", 
        "CommandName": "regedit /e c:\\XSOAR-XSOAR__a.reg", 
        "Host": "XSOAR-XSOAR", 
        "CommandResult": null
    }
}

ps-remote-export-mft

Extracts the master file table from the volume.

Base Command

ps-remote-export-mft

Input

Argument Name	Description	Required
host	A single hostname or IP address on which to run the command.	Required
volume	The volume from which to retrieve its master file table.	Optional
output_path	The path in which the MFT file is to be created.	Optional

Context Output

Path	Type	Description
PsRemote.ExportMFT	unknown	The extract master file table command result.
PsRemote.Host	string	The host on which the command was invoked.
PsRemote.FQDN	string	The Fully Qualified Domain Name of the host on which the command was invoked.

Command Example

!ps-remote-export-mft host="XSOAR-XSOAR" volume=C

Human Readable Output

MFT Export results

ComputerName MFT File MFT Size MFT Volume NetworkPath PSComputerName PSShowComputerName RunspaceId

XSOAR-XSOAR C:\Users\ADMINI~1\AppData\Local\Temp\zzthh5sh.hl2 222 MB C \\XSOAR-XSOAR\C$\Users\ADMINI~1\AppData\Local\Temp\zzthh5sh.hl2 XSOAR-XSOAR.winrm.local true {“value”:”58aa1f39-f86d-4f18-978a-c9257295df49”,”Guid”:”58aa1f39-f86d-4f18-978a-c9257295df49”}

ComputerName	MFT File	MFT Size	MFT Volume	NetworkPath	PSComputerName	PSShowComputerName	RunspaceId
XSOAR-XSOAR	C:\Users\ADMINI~1\AppData\Local\Temp\zzthh5sh.hl2	222 MB	C	\\XSOAR-XSOAR\C$\Users\ADMINI~1\AppData\Local\Temp\zzthh5sh.hl2	XSOAR-XSOAR.winrm.local	true	{“value”:”58aa1f39-f86d-4f18-978a-c9257295df49”,”Guid”:”58aa1f39-f86d-4f18-978a-c9257295df49”}

Context Example

{
    "PsRemote": {
        "ExportMFT": {
            "ComputerName": "XSOAR-XSOAR", 
            "MFT File": "C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\zzthh5sh.hl2", 
            "MFT Size": "222 MB", 
            "PSComputerName": "XSOAR-XSOAR.winrm.local", 
            "NetworkPath": "\\\\XSOAR-XSOAR\\C$\\Users\\ADMINI~1\\AppData\\Local\\Temp\\zzthh5sh.hl2", 
            "MFT Volume": "C", 
            "RunspaceId": "58aa1f39-f86d-4f18-978a-c9257295df49", 
            "PSShowComputerName": true
        }, 
        "Host": "XSOAR-XSOAR", 
        "FQDN": "XSOAR-XSOAR.winrm.local"
    }
}

Configuration parameters

domain — Domain
dns — DNS
credentials — Username (required)
host — Test Host
auth_method — Authentication Method (required)
insecure — Trust any certificate (not secure)
ssl — Use SSL (HTTPS)

Commands (7)

ps-remote-command
Executes remote PowerShell commands on a single host.
ps-remote-download-file
Downloads a file from the remote endpoint.
ps-remote-etl-create-start
This command starts the recording of an ETL file on a Windows endpoint. An ETL file is just like a PCAP file which is created by the Windows Netsh command.
ps-remote-etl-create-stop
Ends the recording of an ETL file on a Windows endpoint.
ps-remote-export-mft
Extracts the master file table from the volume.
ps-remote-export-registry
Exports the specified registry of hive to a file.
ps-remote-upload-file
Uploads a file to the remote endpoint.

Source

PowerShellRemoting.Tests.ps1 PowerShellRemoting.ps1 PowerShellRemoting.yml PowerShellRemoting_description.md

Download History Raw

category: Utilities
provider: Microsoft
sectionorder:
- Connect
- Collect
commonfields:
  id: PowerShell Remoting
  version: -1
configuration:
- additionalinfo: Fully Qualified Domain Name suffix to be added to the hostname. For example mydomain.local
  display: Domain
  name: domain
  type: 0
  required: false
  section: Connect
- display: DNS
  additionalinfo: Optional IP address of a DNS server the integration will use to resolve your hosts. Use this setting when the host linux machine uses a different DNS from the Windows machines you are targeting.
  name: dns
  type: 0
  required: false
  section: Connect
- additionalinfo: Username in the target machine. This can be a local or domain user with administrative privileges
  display: Username
  name: credentials
  required: true
  type: 9
  section: Connect
- additionalinfo: Hostname or IP address to use as a test for the integration connectivity.
  display: Test Host
  name: host
  type: 0
  required: false
  section: Connect
- defaultvalue: Negotiate
  display: Authentication Method
  name: auth_method
  options:
  - Negotiate
  - Basic
  required: true
  type: 15
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use SSL (HTTPS)
  name: ssl
  type: 8
  required: false
  section: Connect
description: "PowerShell Remoting is a comprehensive built-in remoting subsystem that is a part of Microsoft's native Windows management framework (WMF) and Windows remote management (WinRM).\nThis feature allows you to handle most remoting tasks in any configuration you might encounter by creating a remote PowerShell session to Windows hosts and executing commands in the created session.\nThe integration includes out-of-the-box commands which supports agentless forensics for remote hosts."
display: PowerShell Remoting (Beta)
name: PowerShell Remoting
script:
  commands:
  - arguments:
    - description: 'A single hostname or IP address on which to run the command.'
      name: host
      required: true
    - description: PowerShell commands (can be single or multiple in order of execution) to run on the target machine.
      name: command
      required: true
    description: Executes remote PowerShell commands on a single host.
    execution: true
    name: ps-remote-command
    outputs:
    - contextPath: PsRemote.Host
      description: The host on which the command was invoked.
      type: string
    - contextPath: PsRemote.FQDN
      description: The Fully Qualified Domain Name of the host on which the command was invoked.
      type: string
    - contextPath: PsRemote.CommandResult
      description: The result of the command run from the target machine.
      type: list
    - contextPath: PsRemote.CommandName
      description: The command sent to the target machine, used as an ID of that query.
      type: string
    - contextPath: PsRemote.UTCTime
      description: Time the command finished execution in UTC time.
      type: string
  - arguments:
    - description: 'Hostname or the IP address on which to run the command.'
      name: host
      required: true
    - description: The path of the file to download.
      name: path
      required: true
    - name: zip_file
      defaultValue: "false"
      description: 'Whether to compress the file. Possible values: "true" and "false". Default is "false".'
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - name: check_hash
      defaultValue: "false"
      description: 'Whether to compare the value of the original file with the downloaded file and return an error if any differences are found. Possible values: "true" and "false". Default is "false".'
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      description: 'Whether to use the host as a prefix for the name of the downloaded version of the file. Possible values: "true" and "false". Default is "false".'
      name: host_prefix
      defaultValue: "false"
      predefined:
      - "true"
      - "false"
    description: Downloads a file from the remote endpoint.
    name: ps-remote-download-file
    outputs:
    - contextPath: PsRemoteDownloadedFile.Host
      description: The host from which the file was downloaded.
      type: string
    - contextPath: PsRemoteDownloadedFile.FQDN
      description: The Fully Qualified Domain Name of the host from which the file was downloaded.
      type: string
    - contextPath: PsRemoteDownloadedFile.FileName
      description: File name.
      type: String
    - contextPath: PsRemoteDownloadedFile.FileSize
      description: File size.
      type: Number
    - contextPath: PsRemoteDownloadedFile.FileMD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: PsRemoteDownloadedFile.FileSHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: PsRemoteDownloadedFile.FileSHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: PsRemoteDownloadedFile.FileExtension
      description: The extension of the file.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The full file name.
      type: String
    - contextPath: File.SSDeep
      description: The ssdeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: The ID for locating the file in the War Room.
      type: String
    - contextPath: File.Info
      description: The file information.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: 'The file extension, for example: "txt".'
      type: String
  - arguments:
    - description: 'A single hostname or IP address on which to run the command.'
      name: host
      required: true
    - description: The path of the file to upload.
      name: path
      required: true
    - description: The file entry ID to upload.
      name: entry_id
      required: true
    - auto: PREDEFINED
      defaultValue: "false"
      description: 'Whether to compress the file before upload. Possible values: "true" and "false". Default is "false".'
      name: zip_file
      predefined:
      - "true"
      - "false"
    - auto: PREDEFINED
      defaultValue: "false"
      description: 'Whether to compare the values of the original file and uploaded file and return an error if any differences are found. Possible values: "true" and "false". Default is "false".'
      name: check_hash
      predefined:
      - "true"
      - "false"
    description: Uploads a file to the remote endpoint.
    name: ps-remote-upload-file
    outputs:
    - contextPath: PsRemoteUploadedFile.FileName
      description: File name.
      type: String
    - contextPath: PsRemoteUploadedFile.FilePath
      description: File path in the remote server.
      type: String
    - contextPath: PsRemoteUploadedFile.FileSize
      description: File size.
      type: Number
    - contextPath: PsRemoteUploadedFile.FileMD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: PsRemoteUploadedFile.FileSHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: PsRemoteUploadedFile.FileSHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: PsRemoteUploadedFile.FileExtension
      description: The extension of the file.
      type: String
    - contextPath: PsRemoteUploadedFile.Host
      description: The host to which the file was uploaded.
      type: string
    - contextPath: PsRemote.FQDN
      description: The Fully Qualified Domain Name of the host the file was uploaded to.
      type: string
  - arguments:
    - description: 'A single hostname or IP address on which to run the command.'
      name: host
      required: true
    - description: The path on the hostname on which to create the ETL file. For example c:\temp\myhost.etl. Default is "C:\Users\<username>\AppData\Local\Temp\NetTraces\NetTrace.etl".
      name: etl_path
      required: true
    - description: 'The filter to apply when creating the ETL file. For example IPv4.Address=1.1.1.1 to capture traffic just from the 1.1.1.1 IP address. If no filter is specified all traffic will be recorded. For more examples, see: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/jj129382(v=ws.11)#using-filters-to-limit-etl-trace-file-details.'
      name: etl_filter
    - defaultValue: "10"
      description: The maximum file size for the ETL. Once the file has reached this size, the capture will stop. For example 10MB. The default size is 10MB.
      name: etl_max_size
    - auto: PREDEFINED
      defaultValue: "no"
      description: 'Whether to overwrite the file in the path. Possible values: "yes" and "no". Default is "no".'
      name: overwrite
      predefined:
      - "yes"
      - "no"
    description: This command starts the recording of an ETL file on a Windows endpoint. An ETL file is just like a PCAP file which is created by the Windows Netsh command.
    name: ps-remote-etl-create-start
    outputs:
    - contextPath: PsRemote.CommandResult
      description: The start ETL command results.
      type: string
    - contextPath: PsRemote.EtlFileName
      description: The name of the ETL file.
      type: string
    - contextPath: PsRemote.EtlFilePath
      description: The path and name of the ETL file.
    - contextPath: PsRemote.CommandName
      description: The name of the command that ran on the host.
      type: string
    - contextPath: PsRemote.FQDN
      description: The Full Qualified Domain Name of the host.
      type: string
    - contextPath: PsRemote.Host
      description: The name of the host.
      type: string
  - arguments:
    - description: 'A single Hostname or IP address on which to run the command.'
      name: host
      required: true
    description: Ends the recording of an ETL file on a Windows endpoint.
    name: ps-remote-etl-create-stop
    outputs:
    - contextPath: PsRemote.CommandResult
      description: The stop ETL command results.
      type: string
    - contextPath: PsRemote.CommandName
      description: The name of the command that ran on the host.
      type: string
    - contextPath: PsRemote.EtlFileName
      description: The name of the ETL file.
      type: string
    - contextPath: PsRemote.EtlFilePath
      description: The path and name of the ETL file.
    - contextPath: PsRemote.Host
      description: The host the command was invoked on.
      type: string
    - contextPath: PsRemote.FQDN
      description: The Fully Qualified Domain Name of the host on which the command was invoked.
      type: string
  - arguments:
    - description: 'A single hostname or IP address on which to run the command.'
      name: host
      required: true
    - defaultValue: all
      description: The registry key or hive to export. For example, reg_key_hive=`HKEY_LOCAL_MACHINE`. If the user specifies "all", the entire registry will be exported. Default is "all".
      name: reg_key_hive
    - description: The path and name on the Windows host where the registry file will be created. For example, file_path=c:\hklm.reg.
      name: file_path
      required: true
    description: Exports the specified registry of hive to a file.
    name: ps-remote-export-registry
    outputs:
    - contextPath: PsRemote.CommandResult
      description: The command results in the remote host - regedit for all or reg export.
      type: string
    - contextPath: PsRemote.RegistryFilePath
      description: The path and name of the registry file.
      type: string
    - contextPath: PsRemote.RegistryFileName
      description: The name of the registry file.
      type: string
    - contextPath: PsRemote.Command.Name
      description: The name of the command that ran on the host.
      type: string
    - contextPath: PsRemote.Fqdn
      description: The Full Qualified Domain Name of the host.
      type: string
    - contextPath: PsRemote.Host
      description: The host on which the command was invoked.
      type: string
    - contextPath: PsRemote.FQDN
      description: The Fully Qualified Domain Name of the host on which the command was invoked.
      type: string
  - arguments:
    - description: 'A single hostname or IP address on which to run the command.'
      name: host
      required: true
    - description: The volume from which to retrieve its master file table.
      name: volume
    - description: The path in which the MFT file is to be created.
      name: output_path
    description: Extracts the master file table from the volume.
    name: ps-remote-export-mft
    outputs:
    - contextPath: PsRemote.ExportMFT
      description: The extract master file table command result.
    - contextPath: PsRemote.Host
      description: The host on which the command was invoked.
      type: string
    - contextPath: PsRemote.FQDN
      description: The Fully Qualified Domain Name of the host on which the command was invoked.
      type: string
  dockerimage: demisto/powershell-ubuntu:7.5.0.10049856
  script: ''
  type: powershell
fromversion: 6.0.0
beta: true
tests:
- No tests (auto formatted)