BasicCollection
Author: Phill Moore
description
Basic Collection
includes (22)
paths
118 pathsfrom 22 targets
› paths use Windows environment syntax
collection commands
# PowerShell Collection Script
# Target: BasicCollection (Compound Target)
# Use KAPE for compound target collection:
# kape.exe --tsource C: --tdest D:\Evidence --target BasicCollection
Write-Host "For compound targets, use KAPE directly for best results." -ForegroundColor Yellow
› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1
Note: This is a compound target that references 12 other targets. KAPE will automatically collect all referenced artifacts.
› cyberchef recipes
- open in cyberchef(opens in new tab)Base64 DecodeDecode Base64 encoded data
- open in cyberchef(opens in new tab)Unicode DecodeDecode Unicode escape sequences
- open in cyberchef(opens in new tab)Registry BinaryDecode binary registry values
Open in CyberChef to decode values extracted from this artifact.