Manual
Search…
⌃K

Get-BluGenieCOMObjectInfo



Get-BluGenieCOMObjectInfo

SYNOPSIS

Get-BluGenieCOMObjectInfo will query for possible COM Object HiJacking.

SYNTAX

Get-BluGenieCOMObjectInfo [[-FilterType] <String>] [[-Pattern] <String>] [[-COMType] <String>] [[-Algorithm] <String>] [-NotMatch] [-Signature] [-ResolveRegKeyPaths] [-TryToResolvePath] [-Walkthrough]
[-ReturnObject] [-OutUnEscapedJSON] [<CommonParameters>]

DESCRIPTION

Get-BluGenieCOMObjectInfo will query for possible COM Object HiJacking. The process searches for .dll and .exe files that can be HiJacked using the registry CLSID.

EXAMPLES

EXAMPLE 1

Command: Get-BluGenieCOMObjectInfo
Description: Return all COM objects that have a value for InprocServer32 or LocalServer32
Notes: The default Hash Algorithm is (MD5)

EXAMPLE 2

Command: Get-BluGenieCOMObjectInfo -Signature -Algorithm SHA256
Description: Return all COM objects, process Signature Authentication Information and set the Hash Algorithm to (SHA256)
Notes:

EXAMPLE 3

Command: Get-BluGenieCOMObjectInfo -Signature -FilterType Signature_Verified -NotMatch -Pattern '^Signed'
Description: Filter type by (Signature_Verified) with a value not like 'Signed'
Notes:

EXAMPLE 4

Command: Get-BluGenieCOMObjectInfo -Pattern '7-Zip'
Description: Filter type by (Caption) with a value like '7-Zip'
Notes:

EXAMPLE 5

Command: Get-BluGenieCOMObjectInfo -TryToResolvePath
Description: Resolve path for any file not identiifed in the registry. The search path is $env:windir and all sub directories.
Notes:

EXAMPLE 6

Command: Get-BluGenieCOMObjectInfo -TryToResolvePath -ResolveRegKeyPaths
Description: Resolve the root registry key and the parent registry key paths
Notes: This will slow the process down. Most of the time this information is not needed. By default this option is not set

EXAMPLE 7

Command: Get-BluGenieCOMObjectInfo -TryToResolvePath -FilterType OnDisk -NotMatch -Pattern 'True'
Description: Query for any InprocServer32 or LocalServer32 Object references that have not been located on the local system disk.
Notes:

EXAMPLE 8

Command: Get-BluGenieCOMObjectInfo -FilterType ComponentId -Pattern '{581b6888-ba70-3d90-a5f9-865f03d29c6b1}'
Description: Query for a Component ID
Notes:

EXAMPLE 9

Command: Get-BluGenieCOMObjectInfo -TryToResolvePath -FilterType Hash -Pattern '5808c2e483c1e42bdd69d8227e80b96f|7a53101d82f382fcbc883b485b01f4e4|a54e980e453ed712a6ecf639ca70f4db'
Description: RegEx pattern to search for several instances
Notes:

EXAMPLE 10

Command: Get-BluGenieCOMObjectInfo -Help
Description: Call Help Information
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter

EXAMPLE 11

Command: Get-BluGenieCOMObjectInfo -WalkThrough
Description: Call Help Information [2]
Notes: If Help / WalkThrough is setup as a parameter, this script will be called to setup the Dynamic Help Menu if not the normal Get-Help will be called with the -Full parameter

EXAMPLE 12

Command: Get-BluGenieCOMObjectInfo -OutUnEscapedJSON
Description: Return all COM objects that have a value for InprocServer32 or LocalServer32 and Return Output as UnEscaped JSON format
Notes: The OutUnEscapedJSON is used to beatify the JSON return and not Escape any Characters. Normal return data is a Hash Table.

EXAMPLE 13

Command: Get-BluGenieCOMObjectInfo -ReturnObject
Description: Return all COM objects that have a value for InprocServer32 or LocalServer32 and Return Output an Object
Notes: The ReturnObject is used to return a PowerShell Object. Normal return data is a Hash Table.

PARAMETERS

FilterType

-FilterType <String>
Description: Filter by Property Type
Notes:
Filter Option = "ComponentId" - Com Object ID
Filter Option = "Caption" - Display name
Filter Option = "KeyRoot" - Parent / Root Registry Key Path
Filter Option = "Type" - Key Type ( InprocServer32 | LocalServer32 )
Filter Option = "KeyPath" - Full Registry Key Path
Filter Option = "KeyValue" - Value from the Full Registry Key Path
Filter Option = "FilePath" - Full Name and Path of the file nested in the Registry Key Value
Filter Option = "Arguments" - Associated Arguments for the command
Filter Option = "Hash" - The Hash value of the Process ( MACTripleDES / MD5 / RIPEMD160 / SHA1 / SHA256 / SHA384 / SHA512 )
Filter Option = "OnDisk" - Is the file located on disk ( True / False )
Filter Option = "Signature_Comment" - Display error message while pulling Signature Information [Note: This is only available if you use the -Signature switch]
Filter Option = "Signature_FileVersion" - File Version and OS Build information in part of the OS [Note: This is only available if you use the -Signature switch]
Filter Option = "Signature_Description" - The description of the files signature [Note: This is only available if you use the -Signature switch]
Filter Option = "Signature_Date" - Date when the file was signed [Note: This is only available if you use the -Signature switch]
Filter Option = "Signature_Company" - The company signing the file [Note: This is only available if you use the -Signature switch]
Filter Option = "Signature_Publisher" - The Publisher signing the file [Note: This is only available if you use the -Signature switch]
Filter Option = "Signature_Verified" - Verification ( Signed / UnSigned / Null ) [Note: This is only available if you use the -Signature switch]
Alias:
ValidateSet: 'Type','ComponentId','Caption','KeyRoot','KeyPath','KeyValue','FilePath','Arguments','OnDisk','Hash','Signature_Comment','Signature_FileVersion','Signature_Description','Signature_Date','Signature
_Company','Signature_Publisher','Signature_Verified'
Required? false
Position? 1
Default value Caption
Accept pipeline input? false
Accept wildcard characters? false

Pattern

-Pattern <String>
Description: Search Pattern using RegEx
Notes: Default Value = '.*'
Alias:
ValidateSet:
Required? false
Position? 2
Default value .*
Accept pipeline input? false
Accept wildcard characters? false

COMType

-COMType <String>
Description: Select which type of COM Object to search for
Notes:
* InprocServer32
* LocalServer32
Alias:
ValidateSet: 'InprocServer32','LocalServer32','All'
Required? false
Position? 3
Default value All
Accept pipeline input? false
Accept wildcard characters? false

Algorithm

-Algorithm <String>
Description: Specifies the cryptographic hash to use for computing the hash value of the contents of the specified file.
Notes: The acceptable values for this parameter are:
- SHA1
- SHA256
- SHA384
- SHA512
- MACTripleDES
- MD5 = (Default)
- RIPEMD160
Alias:
ValidateSet: 'MACTripleDES','MD5','RIPEMD160','SHA1','SHA256','SHA384','SHA512'
Required? false
Position? 4
Default value MD5
Accept pipeline input? false
Accept wildcard characters? false

NotMatch

-NotMatch [<SwitchParameter>]
Description: Show only results that do not match the given Pattern
Notes:
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false

Signature

-Signature [<SwitchParameter>]
Description: Query Signature information
Notes:
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false

ResolveRegKeyPaths

-ResolveRegKeyPaths [<SwitchParameter>]
Description: Identify and resolve the Component ID to the parent registry key.
Notes: This slows down the query process and is disabled by default.
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false

TryToResolvePath

-TryToResolvePath [<SwitchParameter>]
Description: Query the $env:windir for the file that does not have a defined path in the Registry by default.
Notes: This slows down the query process and is disabled by default.
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false

Walkthrough

-Walkthrough [<SwitchParameter>]
Description: Start the dynamic help menu system to help walk through the current command and all of the parameters
Notes:
Alias: Help
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false

ReturnObject

-ReturnObject [<SwitchParameter>]
Description: Return information as an Object
Notes: By default the data is returned as a Hash Table
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false

OutUnEscapedJSON

-OutUnEscapedJSON [<SwitchParameter>]
Description: Remove UnEsacped Char from the JSON information.
Notes: This will beautify json and clean up the formatting.
Alias:
ValidateSet:
Required? false
Position? named
Default value False
Accept pipeline input? false
Accept wildcard characters? false

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.