davehull / Kansa

A Powershell incident response framework

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Get-Autorunsc output issues

Ade10 opened this issue · comments

commented

Hello,

I just downloaded kansa today and used the ASEP\Get-Autorunsc.ps1.

The output does not contain the autorun output i expect. See the output below.

Kindly advise.

PSComputerName,"RunspaceId","PSShowComputerName","Length"
Machine_name,"56d62496-1558-41e8-b9e8-05682612a8bd","True","0"

What was the command you ran?

commented

Hi,

Thanks for responding.

  1. I edited the modules.conf file to un-comment the line below
    ASEP\Get-Autorunsc.ps1

  2. I edited the Get-Autorunsc.ps1 script to include the path of the autorunsc.exe as below. This was inserted after the notes, outside the <# #> section

#BINDEP .\Modules\bin\Autorunsc.exe

if (Test-Path "$env:SystemRoot\Autorunsc.exe") {
& $env:SystemRoot\Autorunsc.exe -accepteula -a * -c -s -h '*' 2> $null | ForEach-Object {
$_
}
} else {
Write-Error "Autorunsc.exe not found in $env:SystemRoot."
}

  1. I ran the kansa.ps1 script with the command line: .\kansa.ps1 -Targetlist .hostlist.txt -Pushbin

Note that all other scripts I have tested are working fine.

Thanks

commented

Please any update with my issue above? Thanks

I've experienced the same, but I haven't had time yet to debug. For what it's worth, try the deep autoruns version, which still seems to work.

Its missing "-nobanner"

& $env:SystemRoot\Autorunsc.exe /accepteula -a * -c -h -s '*' -nobanner 2> $null | ConvertFrom-Csv | ForEach-Object {