Possible acquisition "powershell.config.json"

[conexioninversa]

Hi all,

I've seen a post on Linekin that PowerShell 7, the execution policy is set via a configuration file instead of the usual registry key used in earlier versions. The "powershell.config.json" file is per user or machine. I have checked and it is correct. It also appears in the Microsoft documentation:

https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_powershell_config?view=powershell-7.3.

Would the possibility that KAPE could acquire this file sound good?

By the way, I continue to develop modules to include in the magnificent tool that is KAPE

Thanks
Pedro.

[AndrewRathbun]

Yeah I don't see why not. You never know if that could hold relevance to an investigation. I'd say it belongs in the Windows Target folder since PowerShell is a native Windows tool. Thoughts?

[conexioninversa]

Yes, I think it is important to acquire since you can put parameters such as 'debug' or 'bypass', it could be included in the KAPE Windows folder but according to Microsoft it is intended to replace the registry key and make the file available for Linux and macOS.

[AndrewRathbun]

@conexioninversa #809 sorry for the delay, this is done now.