Skip to content

Commit

Permalink
Update UsersFolders
Browse files Browse the repository at this point in the history
  • Loading branch information
@vxsh4d0w
vxsh4d0w authored Jan 2, 2024
1 parent 2f2f965 commit 30fbaf6
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion Targets/Windows/UsersFolders
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ Targets:
-
Name: Users
Category: Application
Path: C:\Users\
Path: C:\Users\%user%\
Recursive: true

# Documentation
Expand Down

5 comments on commit 30fbaf6

@EricZimmerman
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's better. This is still a pretty broad thing to include by default. Thoughts @AndrewRathbun ?

@AndrewRathbun
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It's nothing I would use because it somewhat defeats the concept of triage, but I suppose if people want it as a running start for grabbing a specific user's User folder, then I guess why not? Maybe adding some context for suggested use under documentation would be ideal?

@AndrewRathbun
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CC: @vxsh4d0w

@EricZimmerman
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this lets you get all users by default, since an unassigned variable == * but you could use tvars %user%=eric and just get eric profile.

@vxsh4d0w
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this lets you get all users by default, since an unassigned variable == * but you could use tvars %user%=eric and just get eric profile.

More than perfect. Thanks so much.

Please sign in to comment.