Manual
Ctrlk
  • BluSapphire Manuals
  • BluSapphire
    • Detections
    • Roles & Permissions
    • Knowledge Base
  • BluGenie
    • Full Function List
    • Functions by Category
    • Artifacts
      • Example Template
      • Tactical Artifacts by Category
        • Combination Query
        • EventLog Query
        • File and Folder Query
          • Query for malicious file types in all users and system temp directories
          • Query Malicious file types from any directory not including the default OS and Install directories
          • Query all users for their Powershell Profile content for Powershell, Powershell_ISE, and VS Code
          • Query to Determine if any lolbin files are installed outside the normal OS and Program Files dir's
        • Network Query
        • Process Query
        • Registry Query
Powered by GitBook
On this page
  1. BluGenie
  2. Artifacts
  3. Tactical Artifacts by Category

File and Folder Query

Query for malicious file types in all users and system temp directoriesQuery Malicious file types from any directory not including the default OS and Install directoriesQuery all users for their Powershell Profile content for Powershell, Powershell_ISE, and VS CodeQuery to Determine if any lolbin files are installed outside the normal OS and Program Files dir's
PreviousQuery the Windows System Log for 104, 517, 1102NextQuery for malicious file types in all users and system temp directories

Last updated 3 years ago