Skip to content

Instantly share code, notes, and snippets.

@vector-sec

vector-sec/gist:9caa8e14b2adba7ab0c215a6bf856953

Created November 28, 2017 15:09
Show Gist options
  • Save vector-sec/9caa8e14b2adba7ab0c215a6bf856953 to your computer and use it in GitHub Desktop.
Save vector-sec/9caa8e14b2adba7ab0c215a6bf856953 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. fightincanary created this gist Nov 28, 2017.
    25 changes: 25 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,25 @@
    $APIKey = 'KEY'
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $url = "https://www.example.com/api/v1/process?q=process_name:certutil.exe"
    $hdrs = @{}
    $hdrs.Add("X-Auth-Token",$APIKey)
    $response = Invoke-RestMethod -Uri $url -Headers $hdrs


    for($i =0; $i -lt $response.total_results; $i++)
    {


    $ProcessId = $response.results[$i].id
    $SegmentId = $response.results[$i].segment_id

    if( $response.results[$i].filemod_count -gt 0)
    {
    $url = "https://www.example.com/api/v2/process/$ProcessId/$SegmentId/event"
    $resp = Invoke-RestMethod -Uri $url -Headers $hdrs

    #$resp.process.filemod_complete | Format-List
    $filemods = $resp.process.filemod_complete
    $filemods
    }
    }