Merge pull request #956 from randomaccess3/master

add block parser
EricZimmerman · Aug 16, 2024 · 7ae60a8 · 7ae60a8
2 parents 4ed32ad + f7237d4
commit 7ae60a8
Showing 1 changed file with 15 additions and 0 deletions.
diff --git a/Modules/Apps/block-parser-zipped.mkape b/Modules/Apps/block-parser-zipped.mkape
@@ -0,0 +1,15 @@
+Description: Block Parser Zipped
+Category: EventLogs
+Author: Phill Moore
+Version: 1.0
+Id: cb817a29-bab0-4051-ac7d-7019d6e2ac65
+BinaryUrl: https://github.com/randomaccess3/block-parser
+ExportFormat: zip
+Processors:
+    -
+        Executable: block-parser.exe
+        CommandLine: -o %destinationDirectory% -z "%sourceDirectory%\Windows\system32\winevt\logs\Microsoft-Windows-PowerShell%4Operational.evtx
+        ExportFormat: zip
+
+# Documentation
+# https://www.fireeye.com/blog/threat-research/2016/02/greater_visibilityt.html