I've been learning PowerShell and the best way to learn is by doing. Scenario:
D:\Tools\chainsaw\chainsaw.exe
D:\Tools\chainsaw\mapping_files\
D:\Tools\chainsaw\sigma_rules\
I added D:\Tools\chainsaw\
to my PATH
I have my Event Logs in let's say C:\TestEventLogs\
which I make my current Directory in PowerShell
chainsaw.exe hunt ./ --rules sigma_rules/ --mapping mapping_files/sigma-mapping.yml --csv text.csv
Now a command like the below would fail because although PowerShell can find chainsaw.exe because it's in my PATH, it's unable to locate the other folders specified by the other two arguments --rules sigma_rules/ --mapping mapping_files/sigma-mapping.yml
Any tips or workaround to this would be appreciated. I am trying to automate some stuff using PS functions and arguments, and I'm stuck at making this work because I don't want to hardcode D:\Tools\chainsaw\mapping_files\
and D:\Tools\chainsaw\sigma_rules\
in the commandline.
CodePudding user response:
As commented, it may be of use for you to create an Environment variable for the file path:
[Environment]::SetEnvironmentVariable("CHAINSAW", D:\Tools\chainsaw, "Machine")
Then you can use that as $env:CHAINSAW\mapping_files\sigma-mapping.yml