Windows.System.TaskScheduler/add Arguments to default artifact results (

#247)
Velocidex · Feb 10, 2020 · 6816605 · 6816605
1 parent 5f7c4e0
commit 6816605
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/artifacts/definitions/Windows/System/TaskScheduler.yaml b/artifacts/definitions/Windows/System/TaskScheduler.yaml
@@ -35,7 +35,9 @@ sources:
         FROM read_file(filenames=FullPath)
 
       - SELECT FullPath,
-            XML.Task.Actions.Exec.Command AS Command,
-            XML.Task.Actions.ComHandler.ClassId AS ComHandler,
-            XML.Task.Principals.Principal.UserId as UserId, XML AS _XML
+            XML.Task.Actions.Exec.Command as Command,
+            XML.Task.Actions.Exec.Arguments as Arguments,
+            XML.Task.Actions.ComHandler.ClassId as ComHandler,
+            XML.Task.Principals.Principal.UserId as UserId,
+            XML as _XML
         FROM foreach(row=Uploads, query=parse_task)