Add files via upload

Author: nullbind

windows/modules/analysis/search/analyze-003-01-events-1102.ps1

@@ -0,0 +1,19 @@
+
+# Script : Invoke-PowerHunt
+# Module : analyze-events-1102-count
+# Version: 1.0
+# Author : Scott Sutherland
+# Summary: This is script is part of the PowerHunt framework.
+# License: 3-clause BSD
+
+
+# Save result summary
+$AnalysisModuleFileName = $_.name -replace(".ps1","-counts.csv")
+$FinalOutput = $CollectedData  | group PrincipalName | Sort-Object count -Descending | select count,name 
+$FinalOutput | Export-Csv -NoTypeInformation "$OutputDirectory\analysis\$AnalysisSubDir\Hunt-$AnalysisModuleFileName"
+
+# Count instances
+$InstanceCount = $FinalOutput | measure | select count -expandproperty count
+
+# Save summary metrics
+$null = $ModuleOutputSummary.Rows.Add("$ModuleType","$CollectionModuleName","$CollectionDataSource","$AnalysisModuleName","$AnalysisType","$InstanceCount")