Create UsersFolders

[vxsh4d0w]

Description

Please include a summary of the change and (if applicable) which issue is fixed.

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

• I have generated a unique GUID for my Target(s)/Module(s)
• I have placed the Target(s)/Module(s) in an appropriate subfolder in Targets or Modules. If one doesn't exist, I have either added it to the Misc folder or created a relevant subfolder with justification
• I have set or updated the version of my Target(s)/Module(s)
• I have verified that KAPE parses the Target(s)/Module(s) successfully via kape.exe, using --tlist/--mlist and corrected any errors
• I have validated my Target(s)/Module(s) against test data and verified they are working as intended
• I have made an attempt to document the artifacts within the Target(s) or Module(s) I am submitting. If documentation doesn't exist, I have placed N/A underneath the Documentation header
• For Targets, I have consulted either the Target Guide, Target Template, Compound Target Guide, or Compound Target Template to ensure my Target(s) follow the same format
• For Modules, I have consulted either the Module Guide, Module Template, Compound Module Guide, or Compound Module Template to ensure my Module(s) follow the same format

If your submission involves an SQLite database, have you considered making an SQLECmd Map for the SQLite database? If you make a Map, please add the SQLite database to the SQLiteDatabases.tkape Compound Target.

Thank you for your submission and for contributing to the DFIR community!

[EricZimmerman]

Why?

You should at least add

%user%

So you can target just one if need be

[vxsh4d0w]

Why?

You should at least add

%user%

So you can target just one if need be

Yes, you're right. Lately, I've observed various incidents where the threat actor used not only a ad-hoc user but also different compromised accounts within the same host, and quite often the folder C:\Users\Public was involved.
It would be great whether was possible to list various users and dump only specific folders.

[EricZimmerman]

It would be of course \ between the paths

[vxsh4d0w]

It would be of course \ between the paths

what do you suggest?

[AndrewRathbun]

@vxsh4d0w can you advise on 30fbaf6#commitcomment-136072586 before we merge, please?

[vxsh4d0w]

@vxsh4d0w can you advise on 30fbaf6#commitcomment-136072586 before we merge, please?

I think that Eric's suggestion is perfect. Thanks again. :)

[AndrewRathbun]

FYSA, this Target never had the .tkape file extension, so I've added it just now. It should appear now after a --sync.

5a69ca4