Giters

p0w3rsh3ll / AutoRuns

šŸš€AutoRuns is a PowerShell module that will help do live incident response and enumerate autoruns artifacts that may be used by legitimate programs as well as malware to achieve persistence.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

issue with firefox update task

p0w3rsh3ll opened this issue Ā· comments

commented

Steps to reproduce

Get-PSAutorun -ScheduledTask
  Path        : 'C:\WINDOWS\system32\Tasks\Mozilla\Firefox Background Update 308046B0AF4A39CB'
  Item        : 'Firefox Background Update 308046B0AF4A39CB'
  Category    : 'Task'
  Value       : 'C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz_log --backgroundtask backgroundupdate'
  ImagePath   : 'C:\Program Files\Mozilla Firefox\firefox.exe --MOZ_LOG sync,prependheader,timestamp,append,maxsize:1,Dump:5 --MOZ_LOG_FILE C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\backgroundupdate.moz'

Expected behavior

get the path to the exe file

Environment data

> $PSVersionTable
Name                           Value
----                           -----
PSVersion                      5.1.19041.2364
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.19041.2364
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1