bootloader.md

# Modify for your environment. Make sure the sourcetype matches the analytic as needed.
[powershell://bootloader]
script = (bcdedit /enum /v) -split "-------------------" | % { if ($_ -match "path\s+(.+)") { Write-Output "Path: $($matches[1])" }; if ($_ -match "identifier\s+(.+)") { Write-Output "Identifier: $($matches[1])" }; if ($_ -match "description\s+(.+)") { Write-Output "Description: $($matches[1])" } }
schedule = 0 0 * * *
#schedule = */5 * * * *
sourcetype = PwSh:bootloader
index=win