PS Remote Get File Sample From Path
This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire a file as forensic evidence for further analysis.
- Pack
- WindowsForensics
- Tasks
- 10
Inputs
- Host — A single hostname or IP address of the machine on which the file is located. For example, testpc01
- FilePath — The path on the host from which to retrieve the file. For example, c:\tmp\test.txt. In case you configure the AddHostNameToFile input as true, the file downloaded to XSOAR will contain the hostname.
- ZipFile — Specify true to zip the MFT file before sending it to XSOAR.
- AddHostNameToFile — Specify true for the downloaded file name to be comprised of the host name or false to keep the file name as configured in the FilePath argument.
Outputs
- AcquiredFile — The acquired file details.
- File — The file to sample.
Commands used
- ps-remote-download-file