PS-Remote Get MFT
This playbook leverages the Windows built-in PowerShell and WinRM capabilities to connect to a Windows host to acquire and export the MFT (Master File Table) as forensic evidence for further analysis.
Windows Forensics · 12 tasks · 5 inputs · 1 output
Inputs
Host— A single hostname or IP address from which to export the registry file. For example, testpc01.FilePath— The path on the host on which to create the MFT file. The default path will be c:\mft.mft. If you the AddHostNameToFile input os "true", the file downloaded to XSOAR will contain the hostname.VolumeForMft— Specify the volume for which to create the MFT. The default is c.ZipMft— Specify "true" to zip the MFT file before sending it to XSOAR.AddHostNameToFile— Specify "true" for the downloaded filename to contain the hostname, or "false" to keep the file name as configured in the FilePath argument.
Outputs
MftDetails— The MFT file details.
Commands used
ps-remote-download-file
ps-remote-export-mft
setEntriesTags