New flag to get a list of Targets/Modules to execute

[groggi]

Summary

I would love to have a way to give KAPE the (compound) Targets/Modules I would like it to run and it returns me the list of all Targets/Modules it will run.

My use case

I really like working with compound Targets and Modules. This makes it very easy to prepare for different scenarios or even have specific ones for different playbooks. To make sure I do not repeat myself I have multiple levels of compound Targets/Modules. A very simple example:

                              ┌───────────┐    ┌─────────────────┐  ┌─────┐
                              │ MyDefault ├───►│ BasicCollection ├─►│ ... │
                              └───────────┘    └─────────────────┘  └─────┘
                                    ▲
                                    │
┌────────────────────────┐    ┌─────┴───────────────────┐
│  MyRansomServerTarget  ├───►│  MyDefaultServerTarget  │
└───────────┬────────────┘    └───┬─────────────────────┘
            │                     │
            ▼                     ▼
┌────────────────────────┐    ┌──────────────┐       ┌─────┐
│ SomeSpecificAppTarget  │    │ ServerTriage │ ─────►│ ... │
└────────────────────────┘    └──────────────┘       └─────┘

Once I have created a new compound Target/Module I usually want to make sure that the new compound Target/Module will run the non-compound Targets/Modules I expect. It is basically a sanity check for myself and to be sure it runs nothing I would not wish to be run. Hence, I am less interested in the compound Targets/Modules that will be processed, but really just the "final" ones. I would find it useful to have something like this:

.\kape.exe --target WebBrowsers --[someNewFlag]

Chrome.tkape, Firefox.tkape, Edge.tkape, [... and so on ...]

I can imagine that this can also be helpful when putting together Targets/Modules. A kind of dry-run.

Does such a feature make sense? Is there any interest in the community to have something like this? Or am I thinking about an unnecessary function and just have too many layers of compound files 😄? I just hope I did not overlook anything in the documentation and something like this already exists.

[EricZimmerman]

use the --sim switch for dry run approaches. "Do not actually copy files to --tdest. Default is FALSE"

you dont need to worry about having the same target in a compound target 2, 3, or 100 times tho, because KAPE keeps track of the target and module IDs and only runs a target or module once.

i can add some more detailed unpacking of the compound target/module in debug output tho, so you can see it do something like:

• Webbrowsers references chrome.tkape
• Webbrowsers references edge.tkape

and so on

i dont see a need for a dedicated switch that you can see being unpacked with --debug, but the fact kape keeps track of what it ran prevents you from doing the same thing more than once.

would that be helpful?

[groggi]

use the --sim switch for dry run approaches. "Do not actually copy files to --tdest. Default is FALSE"

--sim didn't catch my eye. Thank you for pointing it out to me.

i can add some more detailed unpacking of the compound target/module in debug output tho, so you can see it do something like:

• Webbrowsers references chrome.tkape
• Webbrowsers references edge.tkape

and so on

Yeah, I think this would be great and more than enough for my use case. A dedicated switch is really not necessary, especially for such niche information.

you dont need to worry about having the same target in a compound target 2, 3, or 100 times tho, because KAPE keeps track of the target and module IDs and only runs a target or module once.

I'm aware of this. It is really more about making sure it will run what I expect and nothing that I would not expect. Usually that's not a problem either, but it gives me more confidence during an investigation.

[Karneades]

One addition, the Invoke-Kape command from Invoke-Forensics has also a -Print (Show) flag, which allows printing a compound easily. It takes one or multiple targets or modules.

Invoke-Kape -Target WebBrowsers -Print