trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add a wait for autoruns scheduled task

Browse Source
This commit is contained in:
Chris Long
2020-03-23 17:27:57 -07:00
parent d9ccdbb162
commit 5dcc9965d3
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
Vagrant/scripts/install-autorunstowineventlog.ps1
View File

@@ -6,6 +6,15 @@ If ((Get-ScheduledTask -TaskName "AutorunsToWinEventLog" -ea silent) -eq $null)
. c:\Users\vagrant\AppData\Local\Temp\windows-event-forwarding-master\AutorunsToWinEventLog\Install.ps1 . c:\Users\vagrant\AppData\Local\Temp\windows-event-forwarding-master\AutorunsToWinEventLog\Install.ps1
Write-Host "AutorunsToWinEventLog installed. Starting the scheduled task. Future runs will begin at 11am" Write-Host "AutorunsToWinEventLog installed. Starting the scheduled task. Future runs will begin at 11am"
Start-ScheduledTask -TaskName "AutorunsToWinEventLog" Start-ScheduledTask -TaskName "AutorunsToWinEventLog"
# https://mcpmag.com/articles/2018/03/16/wait-action-function-powershell.aspx
# Wait 30 seconds for the scheduled task to enter the "Running" state
$Timeout = 30
$timer = [Diagnostics.Stopwatch]::StartNew()
while (($timer.Elapsed.TotalSeconds -lt $Timeout) -and ((Get-ScheduledTask -TaskName "AutorunsToWinEventLog").State -ne "Running")) {
Start-Sleep -Seconds 3
Write-Host "Still waiting for scheduled task to start after "$timer.Elapsed.Seconds" seconds..."
}
$timer.Stop()
$Tsk = Get-ScheduledTask -TaskName "AutorunsToWinEventLog" $Tsk = Get-ScheduledTask -TaskName "AutorunsToWinEventLog"
if ($Tsk.State -ne "Running") if ($Tsk.State -ne "Running")
{ {