Running kape with Carbon Black live response

[Wouts76]

Hi, I'm totally new on Kape. I'm trying to see if we can run it using the carbon balck EDR live response. Made a the folders KAPE and KAPE/Targets on a testmachine.
I'm running, as a test, the command "execfg .\kape.exe --tsource C: -–tdest C:\temp -–target PowerShellConsole --zip" to try and get some output.
It however does not execute but I get an error "--target is required. Exiting".

I checked that the PowerShellConsole.tkape file exist in the Targets folder. I does.

What am I doing wrong? Tried several targets. No luck yet.

[AndrewRathbun]

Look at the second - character before --Target and --tdest, does that look weird to you or is that just GitHub formatting it weird?

Be sure to use backticks when pasting commands so we know the exact command being used

[Wouts76]

Thank you Andrew, I just didn't see that second dash being weird. That did it for me. I was able to run kape on the test machine. It works.

[EricZimmerman]

If you look on the kapedocs website, there is a bunch of information on how to use it with different tools like carbon, black and falcon. So if you look there it'll give you examples of how they're doing it and where they're staging it. But I know it's possible because we do it and tons of other people do as well with different EDR tools

[AndrewRathbun]

https://ericzimmerman.github.io/KapeDocs/#!Pages\60-Tips-and-tricks.md#Using_KAPE_with_CrowdStrike_Falcon_(Real_Time_Response)

Posting for posterity.

[Wouts76]

Thanks Eric, indeed it works. :)