Skip to content

Releases: mattifestation/CimSweep

Version 0.6.1.1

08 Jun 17:15
Compare
Choose a tag to compare

Enhancements:

  • Added Get-CSEventLogPermission
  • Added the following from @secabstraction: Get-CSAppCompatCache, Get-CSNetworkProfile, Get-CSUserAssist
  • Bugfix: Removed .ForEach PSv4 language dependency
  • Renamed Get-CSVulnerableServicePermission to Get-CSServicePermission

Version 0.6.0

13 May 16:12
Compare
Choose a tag to compare

Enhancements:

  • Added Get-CSInstalledAppCompatShimDatabase
  • Added Get-CSBitlockerKeyProtector
  • Get-CSWmiPersistence now also detects persistence in the root/default namespace.
  • Added Get-CSDeviceGuardStatus
  • Added positional parameters for Name parameters for Get-CSEventLogEntry, Get-CSService, Get-CSProcess, Get-CSEnvironmentVariable, and Get-CSWmiNamespace.

Removed:

  • Removed the -NoProgressBar parameter from all functions since this is what $ProgressPreference is for.
  • Removed Set-DefaultDisplayProperty helper function and all calls to it. It was creating unnecessary code complexity.
  • Removed -OperationTimeoutSec param from all functions. Was creating unnecessary code complexity.

General changes:

  • Reorganized the folder structure and removed any offensive code.
  • A decision was also made that CimSweep will only ever have Get- functions. Considering CimSweep is designed to pull information at scale, it should never perform any action that would change system state.
  • Applied PSScriptAnalyzer rules to test code and addressed its findings.

Version 0.5.1

08 Oct 16:54
Compare
Choose a tag to compare

Enhancements:

  • Added Get-CSAVInfo (written by @xorrior)
  • Added Get-CSProxyConfig (written by @xorrior)
  • Added module-wide Pester tests to ensure consistency across functions.

Removed:

  • Removed the -Path parameter from Get-CSRegistryKey and Get-CSRegistryValue. -Hive should be used.

Version 0.5.0

28 May 17:37
Compare
Choose a tag to compare

Enhancements:

  • Added Get-CSWmiNamespace
  • Added Get-CSVulnerableServicePermission
  • -IncludeACL added to Get-CSRegistryKey, Get-CSDirectoryListing, Get-CSService, and Get-CSWmiNamespace.
  • -IncludeFileInfo added to Get-CSService. The file info returned also includes the file ACL.
  • Functions that accept exact datetimes now mask off milliseconds to enable more flexible time-based sweeps with second granularity.
  • Added optional -UserModeServices and -Drivers switches to Get-CSService. This is helpful if you only want drivers or only want user-mode services.

Removed:

  • Dropped -Drivers and -Services from Get-CSRegistryAutoStart. Get-CSService is the ideal means of obtaining service and driver information.

Version 0.4.1

16 May 22:05
Compare
Choose a tag to compare
  • Bigfix: Forgot to rename Set-DefaultDisplayProperty in Get-CSRegistryAutoStart.
  • Enhancement: Addressed PSScriptAnalyzer warnings

Version 0.4.0

16 May 19:59
Compare
Choose a tag to compare
  • Compatible PS Editions: Desktop, Core (i.e. Nano Server and Win 10 IoT)
  • -IncludeAcl switch added to Get-CSRegistryKey and Get-CSDirectoryListing. Appending this argument will add an ACL parameter to each object returned.
  • The output types of all functions are now fully and properly documented.