Carbon Black API - PowerShell Example - Find All FileMods By certutil.exe - Type 1 == PE Write.

gistfile1.txt

$APIKey = 'KEY'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$url = "https://www.example.com/api/v1/process?q=process_name:certutil.exe"
$hdrs = @{}
$hdrs.Add("X-Auth-Token",$APIKey)
$response = Invoke-RestMethod -Uri $url -Headers $hdrs 


for($i =0; $i -lt $response.total_results; $i++)
{
    

    $ProcessId = $response.results[$i].id
    $SegmentId = $response.results[$i].segment_id

    if( $response.results[$i].filemod_count -gt 0)
    {
        $url = "https://www.example.com/api/v2/process/$ProcessId/$SegmentId/event" 
        $resp = Invoke-RestMethod -Uri $url -Headers $hdrs 
        
        #$resp.process.filemod_complete | Format-List
        $filemods = $resp.process.filemod_complete
        $filemods
    }
}