digitalcroqueta / bits_parser

Extract BITS jobs from QMGR queue and store them as CSV records

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

bits_parser

Extract BITS jobs from QMGR queue and store them as pipe-delimited records.

This is forked from ANSSI bits_parser to refactor as a simple Python 2.7 script.

Usage

QMGR queues are usually .dat files located in the folder %%ALLUSERSPROFILE%%\Microsoft\Network\Downloader on a Windows system.

Once those files have been located (e.g. qmgr0.dat and qmgr1.dat) you can run bits_jobs_parser.py by issuing the following command passing the directory containing the files:

python bits_jobs_parser.py C:\ProgramData\Microsoft\Network\Downloader\

Related works

Finding your naughty BITS [DFRWS USA 2015, Matthew Geiger]

BITSInject [DEFCON 2017, Dor Azouri]

ANSSI bits_parser [Project forked]

About

Extract BITS jobs from QMGR queue and store them as CSV records

License:MIT License


Languages

Language:Python 100.0%