Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add Mplog-Parser to parse Windows Defender MPLog #900

Merged
merged 1 commit into from
Jan 31, 2024

Conversation

Qazeer
Copy link
Contributor

@Qazeer Qazeer commented Jan 31, 2024

Description

Add Mplog-Parser module to parse Windows Defender MPLog files.

As a side note, it would be useful to have a %sourceFileDirectory% variable for case like this one, as the tool takes into parameter a folder but does not recursively process it. The variable would return the directory path of file(s) that match a FileMask. It would have a few benefits, including the support of piping a target collection directly as the module source (without having to manually add the drive letter to the module source), and allow processing of multiple folders that might contain MPLog files (in addition to the default location).

Checklist:

Please replace every instance of [ ] with [X] OR click on the checkboxes after you submit your PR

  • I have generated a unique GUID for my Target(s)/Module(s)
  • I have placed the Target(s)/Module(s) in an appropriate subfolder in Targets or Modules. If one doesn't exist, I have either added it to the Misc folder or created a relevant subfolder with justification
  • I have set or updated the version of my Target(s)/Module(s)
  • I have verified that KAPE parses the Target(s)/Module(s) successfully via kape.exe, using --tlist/--mlist and corrected any errors
  • I have validated my Target(s)/Module(s) against test data and verified they are working as intended
  • I have made an attempt to document the artifacts within the Target(s) or Module(s) I am submitting. If documentation doesn't exist, I have placed N/A underneath the Documentation header
  • For Modules, I have consulted either the Module Guide, Module Template, Compound Module Guide, or Compound Module Template to ensure my Module(s) follow the same format

Copy link
Collaborator

@AndrewRathbun AndrewRathbun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks very useful!

@AndrewRathbun AndrewRathbun merged commit d420b04 into EricZimmerman:master Jan 31, 2024
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants