Re: [ossec-list] USB storage detect & recursive file list

2016-04-19 Thread Pedro Sanchez
Hi, Nice commands, very useful, thanks for sharing. Both commands are working on my labs, the second one prints the full list of files at the terminal and writes into C:\temp\test.txt file (watch out the last *" *quotes before ). I am not sure if you need to merge the two commands output into

[ossec-list] USB storage detect & recursive file list

2016-04-19 Thread Jacob Mcgrath
I have a basic Windows agent setting to alert me when a storage device is detected using Power shell.. full_command powershell.exe -command "gwmi win32_diskdrive | select Model,InterfaceType,serialnumber,Size,MediaType,CapabilityDescriptions > C:\temp\usbdetect.txt ; (gc