Skip to content

Commit

Permalink
Update Windows.Binary.Exports artifact (#982)
Browse files Browse the repository at this point in the history
Windows.Binary.Exports artifact was not working in recent Velociraptor
version and needed an update.
  • Loading branch information
utkutombul authored Jan 23, 2025
1 parent 4e9f105 commit 3d83a3e
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions content/exchange/artifacts/Exports.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,17 +21,17 @@ sources:
WHERE NOT IsDir
LET all_binary_info = SELECT
dict(FullPath=FullPath,Name=Name,Size=Size,IsLink=IsLink) as FileDetails,
dict(OSPath=OSPath,Name=Name,Size=Size,IsLink=IsLink) as FileDetails,
dict(Mtime=Mtime,Atime=Atime,Ctime=Ctime,Btime=Btime) as SI,
parse_pe(file=FullPath) as BinaryInfo,
authenticode(filename=FullPath) as Authenticode,
hash(path=FullPath) as Hash
parse_pe(file=OSPath) as BinaryInfo,
authenticode(filename=OSPath) as Authenticode,
hash(path=OSPath) as Hash
FROM Targets
WHERE BinaryInfo
LET binary_exports = SELECT
dict(FullPath=FullPath,Name=Name,Size=Size,IsLink=IsLink) as FileDetails,
parse_pe(file=FullPath).Exports as Exports
dict(OSPath=OSPath,Name=Name,Size=Size,IsLink=IsLink) as FileDetails,
parse_pe(file=OSPath).Exports as Exports
FROM Targets
WHERE Exports
Expand Down

0 comments on commit 3d83a3e

Please sign in to comment.