Skip to content

Instantly share code, notes, and snippets.

@scudette
Created July 12, 2021 02:25
Show Gist options
  • Save scudette/e24c32528b4aee679209b688afa40839 to your computer and use it in GitHub Desktop.
Save scudette/e24c32528b4aee679209b688afa40839 to your computer and use it in GitHub Desktop.
SELECT "C:/" + FullPath AS FullPath,
InUse,FileName,FileSize,
dict(
Created0x10 = Created0x10,
LastModified0x10 = LastModified0x10,
LastRecordChange0x10 = LastRecordChange0x10,
LastAccess0x10 = LastAccess0x10
) as SI,
dict(
Created0x30 = Created0x10,
LastModified0x30 = LastModified0x10,
LastRecordChange0x30 = LastRecordChange0x10,
LastAccess0x30 = LastAccess0x10
) as FN,
parse_pe(file="C:/" + FullPath) as PE,
authenticode(filename="C:/" + FullPath) as Authenticode,
hash(path="C:/" + FullPath) as Hash
FROM parse_mft(filename="C:/$MFT", accessor="ntfs")
WHERE NOT IsDir
AND FullPath =~ "Windows/System32/spool/drivers"
AND PE
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment