Added a VQL collect plugin to collect artifacts into a local file. (#86)

Velocidex · Sep 27, 2019 · ee0ce3d · ee0ce3d
1 parent cced111
commit ee0ce3d
Show file tree

Hide file tree

Showing 37 changed files with 184 additions and 1,694 deletions.
diff --git a/artifacts/assets/ab0x.go b/artifacts/assets/ab0x.go
diff --git a/artifacts/definitions/Windows/Collectors/VSS.yaml b/artifacts/definitions/Windows/Collectors/VSS.yaml
@@ -90,7 +90,7 @@ sources:
 
       # Upload the files using the MFT accessor.
       - LET uploaded_tiles = SELECT Created, LastAccessed, Modified, MFT, SourceFile, Size,
-               upload(file=Device+MFT, name=Device + SourceFile, accessor="mft") AS Upload
+               upload(file=Device+MFT, name=SourceFile, accessor="mft") AS Upload
         FROM unique_mtimes
 
       # Seperate the hashes into their own column.

diff --git a/...cts/definitions/Windows/Kape/Targets.yaml → ...efinitions/Windows/KapeFiles/Targets.yaml b/...cts/definitions/Windows/Kape/Targets.yaml → ...efinitions/Windows/KapeFiles/Targets.yaml
@@ -1,4 +1,4 @@
-name: Windows.Kape.Targets
+name: Windows.KapeFiles.Targets
 description: |
 
     Kape is a popular bulk collector tool for triaging a system
@@ -806,5 +806,3 @@ sources:
   - name: Uploads
     queries:
       - SELECT * FROM all_results WHERE _Source =~ "Uploads"
-
-
diff --git a/artifacts/definitions/Windows/Triage/Collectors/Amcache.yaml b/artifacts/definitions/Windows/Triage/Collectors/Amcache.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/BCD.yaml b/artifacts/definitions/Windows/Triage/Collectors/BCD.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/Chrome.yaml b/artifacts/definitions/Windows/Triage/Collectors/Chrome.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/Edge.yaml b/artifacts/definitions/Windows/Triage/Collectors/Edge.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/EventLogs.yaml b/artifacts/definitions/Windows/Triage/Collectors/EventLogs.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/EventTraceLogs.yaml b/artifacts/definitions/Windows/Triage/Collectors/EventTraceLogs.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/EvidenceOfExecution.yaml b/artifacts/definitions/Windows/Triage/Collectors/EvidenceOfExecution.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/Firefox.yaml b/artifacts/definitions/Windows/Triage/Collectors/Firefox.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/InternetExplorer.yaml b/artifacts/definitions/Windows/Triage/Collectors/InternetExplorer.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/Jabber.yaml b/artifacts/definitions/Windows/Triage/Collectors/Jabber.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/LnkFiles.yaml b/artifacts/definitions/Windows/Triage/Collectors/LnkFiles.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/NTFSMetadata.yaml b/artifacts/definitions/Windows/Triage/Collectors/NTFSMetadata.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/OutlookPST.yaml b/artifacts/definitions/Windows/Triage/Collectors/OutlookPST.yaml
diff --git a/artifacts/definitions/Windows/Triage/Collectors/PowershellConsoleLogs.yaml b/artifacts/definitions/Windows/Triage/Collectors/PowershellConsoleLogs.yaml