1
2
3
4
5
6 from lib.common.abstracts import Package
7
8
9
11 """PowerShell analysis package."""
12 PATHS = [
13 ("System32", "WindowsPowerShell", "v1.0", "powershell.exe"),
14 ("System32", "WindowsPowerShell", "v2.0", "powershell.exe"),
15 ("System32", "WindowsPowerShell", "v3.0", "powershell.exe"),
16 ]
17
19 powershell = self.get_path("PowerShell")
20 args = [
21 "-NoProfile", "-ExecutionPolicy", "unrestricted", "-File", path
22 ]
23 return self.execute(powershell, args=args, trigger="file:%s" % path)
24