How to use the artifacts.win_artifacts.AbstractWMIArtifact function in artifacts

To help you get started, we’ve selected a few artifacts examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github google / grr / artifacts / win_artifacts.py View on Github external
LABELS = ["Software"]
  SUPPORTED_OS = ["Windows"]
  COLLECTORS = [
      Collector(action="CollectArtifactFiles",
                args={"artifact_list": ["WindowsPersistenceMechanisms"],
                      "pathspec_attribute": "pathspec"},
                returned_types=["StatEntry"])
      ]


################################################################################
#  User Artifacts
################################################################################


class WindowsAdminUsers(AbstractWMIArtifact):
  """Extract the Aministrators on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT * "
                               "from Win32_GroupUser where Name = \"Administrators\""}
               )
  ]


class WindowsLoginUsers(AbstractWMIArtifact):
  """Extract the Login Users on Windows via WMI.

  If on a domain this will query the domain which may take a long time and
  create load on a domain controller.
github google / grr / artifacts / win_artifacts.py View on Github external
]


class WindowsDrivers(AbstractWMIArtifact):
  """Extract the installed drivers on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT DisplayName, Description, InstallDate, Name, PathName, Status, State, ServiceType "
                               "from Win32_SystemDriver"}
               )
  ]


class WindowsHotFixes(AbstractWMIArtifact):
  """Extract the installed hotfixes on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT * "
                               "from Win32_QuickFixEngineering"}
               )
  ]


class WindowsRunKeys(Artifact):
  """Collect windows run keys."""
  LABELS = ["Software"]
  SUPPORTED_OS = ["Windows"]
  COLLECTORS = [
github google / grr / artifacts / win_artifacts.py View on Github external
class SecurityEventLog(AbstractEventLog):
  """Windows Security Event Log."""
  COLLECTORS = [
      Collector(
          action="GetFile",
          args={"path": r"%%environ_systemroot%%\System32\winevt\Logs\SecEvent.evt"}
          )]


################################################################################
#  Software Artifacts
################################################################################


class WindowsWMIInstalledSoftware(AbstractWMIArtifact):
  """Extract the installed software on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT Name, Vendor, Description, InstallDate, InstallDate2, Version "
                               "from Win32_Product"}
               )
  ]


class WindowsDrivers(AbstractWMIArtifact):
  """Extract the installed drivers on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
github google / grr / artifacts / win_artifacts.py View on Github external
################################################################################


class WindowsAdminUsers(AbstractWMIArtifact):
  """Extract the Aministrators on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT * "
                               "from Win32_GroupUser where Name = \"Administrators\""}
               )
  ]


class WindowsLoginUsers(AbstractWMIArtifact):
  """Extract the Login Users on Windows via WMI.

  If on a domain this will query the domain which may take a long time and
  create load on a domain controller.
  """
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT * "
                               "from Win32_GroupUser where Name = \"login_users\""}
               )
  ]


class WMIProcessList(AbstractWMIArtifact):
github google / grr / artifacts / win_artifacts.py View on Github external
################################################################################


class WindowsWMIInstalledSoftware(AbstractWMIArtifact):
  """Extract the installed software on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT Name, Vendor, Description, InstallDate, InstallDate2, Version "
                               "from Win32_Product"}
               )
  ]


class WindowsDrivers(AbstractWMIArtifact):
  """Extract the installed drivers on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT DisplayName, Description, InstallDate, Name, PathName, Status, State, ServiceType "
                               "from Win32_SystemDriver"}
               )
  ]


class WindowsHotFixes(AbstractWMIArtifact):
  """Extract the installed hotfixes on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
github google / grr / artifacts / win_artifacts.py View on Github external
"""Extract the Login Users on Windows via WMI.

  If on a domain this will query the domain which may take a long time and
  create load on a domain controller.
  """
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT * "
                               "from Win32_GroupUser where Name = \"login_users\""}
               )
  ]


class WMIProcessList(AbstractWMIArtifact):
  """Extract the process list on Windows via WMI."""
  LABELS = ["Software"]

  COLLECTORS = [
      Collector(action="WMIQuery",
                args={"query": "SELECT * "
                               "from Win32_Process"}
               )
  ]


################################################################################
#  Network Artifacts
################################################################################