Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adding Active Directory Timeline module #923

Merged
merged 4 commits into from
Apr 5, 2024
Merged

Adding Active Directory Timeline module #923

Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
55baf07
Create PowerShell_AD_Timeline.mkape
cert-cwatch Apr 2, 2024
862ada4
Update and rename Modules/PowerShell_AD_Timeline.mkape to Modules/App…
AndrewRathbun Apr 2, 2024
4350f66
Update PowerShell_AD_Timeline.mkape
AndrewRathbun Apr 2, 2024
6765c59
Update PowerShell_AD_Timeline.mkape
AndrewRathbun Apr 5, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions Modules/Apps/GGitHub/PowerShell_AD_Timeline.mkape
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
Description: ADTimeline.ps1 - The ADTimeline script generates a timeline based on Active Directory replication metadata for objects considered of interest.
Category: GitHub
Author: Tristan PINCEAUX - CERT CWATCH - ALMOND
Version: 1.0
Id: 6666cc62-821f-4b13-b13a-03c768b40f71
BinaryUrl: https://raw.githubusercontent.com/ANSSI-FR/ADTimeline/master/ADTimeline.ps1
ExportFormat: csv, log, xml
AndrewRathbun marked this conversation as resolved.
Show resolved Hide resolved
Processors:
-
Executable: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLine: "-ep bypass & '%kapeDirectory%\\Modules\\bin\\ADTimeline.ps1'; Move-Item timeline_*.csv -Destination %destinationDirectory%; Move-Item logfile_*.log -Destination %destinationDirectory%; Move-Item ADobjects_*.xml -Destination %destinationDirectory%; Move-Item gcADobjects_*.xml -Destination %destinationDirectory% "
ExportFormat: csv, log, xml
AndrewRathbun marked this conversation as resolved.
Show resolved Hide resolved

# Documentation
# ADtimeline is a PowerShell script created by the ANSSI (French Cybersecurity Agency).
# You can use the output of this script to determine persistance, sensitives accounts, suspicious activities...
# You need to run this script on a live domain controller.
# This script will generate four files:
# - timeline_%DOMAINFQDN%.csv: The timeline generated with the AD replication metadata of objects retrieved.
# - logfile_%DOMAINFQDN%.log: Script log file. You will also find various information on the domain.
# - ADobjects_%DOMAINFQDN%.xml: Objects of interest retrieved via LDAP.
# - gcADobjects_%DOMAINFQDN%.xml: Objects of interest retrieved via the Global Catalog.
# https://github.com/ANSSI-FR/ADTimeline
# https://www.first.org/resources/papers/amsterdam2019/AD_Timeline_FIRST_TC.pdf
Loading