Skip to main content

r_powershell

The r_powershell tool is designed to execute PowerShell commands on compromised Windows systems within Canva's automated security workflows. It enables workflow builders to perform advanced command execution, facilitating real-time interactions with systems under investigation.

Ideal Use Cases & Fit​

This tool is particularly effective in scenarios involving:

  • Incident response, where immediate execution of diagnostic commands is needed to assess system integrity.
  • Post-exploitation phases, allowing operators to gather detailed information about a compromised environment.
  • Scripted automated responses that require specific commands to be executed based on detected security events.

It is not suitable for environments where PowerShell execution is heavily restricted or where system integrity must be preserved.

Value in Workflows​

Integrating r_powershell into security workflows enhances the capability to react promptly to security incidents. It can occupy positions for both early reconnaissance and post-processing, allowing operators to gather valuable data and insights efficiently. By automating command execution, it speeds up the investigation timeline and reduces manual effort.

Input Data​

The tool accepts a single input file:

  • Format: Text
  • Function: Target
  • Required: Yes
  • Example: A file named input.txt containing commands or target information, such as a hostname.

Configuration​

Key configurable parameters include:

  • target: Specifies the input file containing the target details or commands to be executed.
  • output: Determines where the JSON-formatted output will be saved, capturing the results of the executed commands.

These parameters ensure that the execution context is well-defined and that results are captured for further analysis.