PS-Remote Get MFT

This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire and export the MFT (Master File Table) as forensic evidence for further analysis.

Pack

WindowsForensics

Tasks

12

Inputs

• Host — A single hostname or IP address from which to export the registry file. For example, testpc01.
• FilePath — The path on the host on which to create the MFT file. The default path will be c:\mft.mft. If you the AddHostNameToFile input os "true", the file downloaded to XSOAR will contain the hostname.
• VolumeForMft — Specify the volume for which to create the MFT. The default is c.
• ZipMft — Specify "true" to zip the MFT file before sending it to XSOAR.
• AddHostNameToFile — Specify "true" for the downloaded filename to contain the hostname, or "false" to keep the file name as configured in the FilePath argument.

Outputs

• MftDetails — The MFT file details.

Commands used

• ps-remote-download-file
• ps-remote-export-mft
• setEntriesTags