Skip to content

Instantly share code, notes, and snippets.

@vector-sec
Created November 28, 2017 15:09
Show Gist options
  • Save vector-sec/9caa8e14b2adba7ab0c215a6bf856953 to your computer and use it in GitHub Desktop.
Save vector-sec/9caa8e14b2adba7ab0c215a6bf856953 to your computer and use it in GitHub Desktop.
Carbon Black API - PowerShell Example - Find All FileMods By certutil.exe - Type 1 == PE Write.
$APIKey = 'KEY'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$url = "https://www.example.com/api/v1/process?q=process_name:certutil.exe"
$hdrs = @{}
$hdrs.Add("X-Auth-Token",$APIKey)
$response = Invoke-RestMethod -Uri $url -Headers $hdrs
for($i =0; $i -lt $response.total_results; $i++)
{
$ProcessId = $response.results[$i].id
$SegmentId = $response.results[$i].segment_id
if( $response.results[$i].filemod_count -gt 0)
{
$url = "https://www.example.com/api/v2/process/$ProcessId/$SegmentId/event"
$resp = Invoke-RestMethod -Uri $url -Headers $hdrs
#$resp.process.filemod_complete | Format-List
$filemods = $resp.process.filemod_complete
$filemods
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment