PS Remote Get File Sample From Path

This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire a file as forensic evidence for further analysis.

Windows Forensics · 10 tasks · 4 inputs · 2 outputs

Inputs

Host — A single hostname or IP address of the machine on which the file is located. For example, testpc01
FilePath — The path on the host from which to retrieve the file. For example, c:\tmp\test.txt. In case you configure the AddHostNameToFile input as true, the file downloaded to XSOAR will contain the hostname.
ZipFile — Specify true to zip the MFT file before sending it to XSOAR.
AddHostNameToFile — Specify true for the downloaded file name to be comprised of the host name or false to keep the file name as configured in the FilePath argument.

Outputs

AcquiredFile — The acquired file details.
File — The file to sample.

Commands used

ps-remote-download-file

PS Remote Get File Sample From Path

Inputs

Outputs

Commands used

Flowchart