<commit_before>commonfields:
  id: Autoruns
  version: 1
name: Autoruns
script: |-
  respAR = demisto.executeCommand( 'D2Autoruns', { 'using' : demisto.args()['system'] } )
  try:
      lines = respAR[0]['Contents'][2:].decode('utf-16').encode('ascii').split('\r\n')
  except Exception, ex:
      demisto.log(str(ex))
      lines = respAR[0]['Contents'].split('\r\n')

  headers = lines[5].replace('\t','|')
  mdTable = headers +'\n'
  mdTable += '|'.join( '---'*len(headers.split('|')) ) + '\n'
  for l in lines[6:]:
          mdTable += l.replace('\t','|') +'\n'

  demisto.results( { 'Type' : entryTypes['note'], 'ContentsFormat' : formats['markdown'], 'Contents': mdTable} )
type: python
tags:
- endpoint
- forensics
comment: |-
  Collect Autoruns items from an endpoint and hashes for each item.
  Uses a d2 agent to run SysInternals Autoruns.
system: true
args:
- name: system
  required: true
  default: true
  description: Name of the system from which to collect data
scripttarget: 0
dependson: {}
timeout: 0s
<commit_msg>Autoruns script - append startup items' MD5s to context "md5s"<commit_after>commonfields:
  id: Autoruns
  version: -1
name: Autoruns
script: |-
  respAR = demisto.executeCommand( 'D2Autoruns', { 'using' : demisto.args()['system'] } )
  try:
      lines = respAR[0]['Contents'][2:].decode('utf-16').encode('ascii').split('\r\n')
  except Exception, ex:
      demisto.log(str(ex))
      lines = respAR[0]['Contents'].split('\r\n')

  hashes = []
  headers = lines[5].replace('\t','|')
  try:
      hashCol = headers.split('|').index('MD5')
  except ValueError as ve:
      hashCol = -1
  mdTable = headers + '\n'
  mdTable += '|'.join( '---'*len(headers.split('|')) ) + '\n'
  for l in lines[6:]:
          if hashCol > -1:
              cells = l.split('\t')
              if hashCol < len(cells) and cells[hashCol].strip():
                  hashes.append(cells[hashCol])
          mdTable += l.replace('\t','|') +'\n'
  if hashes:
      appendContext('md5s', ', '.join(hashes), dedup = True)
  demisto.results( { 'Type' : entryTypes['note'], 'ContentsFormat' : formats['markdown'], 'Contents': mdTable} )
type: python
tags:
- endpoint
- forensics
comment: |-
  Collect Autoruns items from an endpoint and hashes for each item.
  Uses a d2 agent to run SysInternals Autoruns.
system: true
args:
- name: system
  required: true
  default: true
  description: Name of the system from which to collect data
scripttarget: 0
dependson: {}
timeout: 0s

{'fraction_non_alphanumeric': 0.17675544794188863, 'fraction_numerical': 0.012106537530266344, 'mean_word_length': 3.4506283662477557, 'pattern_counts': {'":': 0, '<': 4, '<?xml version=': 0, '>': 4, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '744728', 'n_tokens_mistral': 857, 'n_tokens_neox': 851, 'n_words': 223}