Updates in this version
The following are a list of developments since the last release and are currently pushed to the repo:
- Official support for processing local collections or disk images, where multiple collections or images have been downloaded to a drive or network share. There is no new command for this, when you have already downloaded the collections/images you provide the
--in-linkwith the word "local" and provide the local path-las the folder where the collections are stored on disk and the--data-source-list,-das the list of files to process, i.e.--in-link local -l x:\ -d "Collection-DC1.zip, Collection-FTP.zip, Veeam.vmdk. You can optionally provide the--out-linkas "local", but you must combine that with the--updateflag. - Timeline file for host information file - useful when only ingesting the timeline folder files into a SIEM
- Timeline file for PowerShell history files, ConsoleHost_history.txt
- Tests to confirm the WISKESS has been setup, and reporting any missing packages. Use the command
setup -cto check if the setup completed completely. - Removed bloat-data in the message field of some timeline files, i.e. shellbags, hayabusa, and restructured others so the message field is easier to read in a CSV.
- Fixed an issue in the network CSV in timeline, where multiple entries were shown for the same event
- Fixed an issue with old-whip and GUI when using whipped, where some collections would not be extracted completely
- artefact collection from disk images on Windows are now done in parallel
Full Changelog: v0.0.7-beta...v0.0.7
What's Changed
- patch issue with moving folders that existed by @vividDuck in #14
- regripper timeline fix by @vividDuck in #15
Full Changelog: v0.0.6...v0.0.7