trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

added pre and post checks for installations

Browse Source
This commit is contained in:
hhofs
2018-05-16 14:56:12 +02:00
parent 6f185b558a
commit 387682e809
15 changed files with 336 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
Vagrant/scripts/install-autorunstowineventlog.ps1
View File

@@ -1,7 +1,19 @@
# Purpose: Installs AutorunsToWinEventLog from the Palantir WEF repo: (https://github.com/palantir/windows-event-forwarding/tree/master/AutorunsToWinEventLog)
# TL;DR - Logs all entries from Autoruns to the Windows event log to be indexed by Splunk
Write-Host "Installing AutorunsToWinEventLog..."
cd "c:\Users\vagrant\AppData\Local\Temp\windows-event-forwarding-master\AutorunsToWinEventLog"
.\Install.ps1
Write-Host "AutorunsToWinEventLog installed. Starting the scheduled task. Future runs will begin at 11am"
Start-ScheduledTask -TaskName "AutorunsToWinEventLog"
If ((Get-ScheduledTask -TaskName "AutorunsToWinEventLog" -ea silent) -eq $null)
{
cd "c:\Users\vagrant\AppData\Local\Temp\windows-event-forwarding-master\AutorunsToWinEventLog"
.\Install.ps1
Write-Host "AutorunsToWinEventLog installed. Starting the scheduled task. Future runs will begin at 11am"
Start-ScheduledTask -TaskName "AutorunsToWinEventLog"
$Tsk = Get-ScheduledTask -TaskName "AutorunsToWinEventLog"
if ($Tsk.State -ne "Running")
{
throw "AutorunsToWinEventLog scheduled tasks wasn't running after starting it"
}
}
else
{
Write-Host "AutorunsToWinEventLog already installed. Moving On."
}