Velociraptor - fast file collector

gistfile1.txt

name: Custom.Windows.NTFS.MFT.FilesMatchingKeywords
description: |
  This artifact scans the $MFT file on the host showing all files
  within the MFT and collects those that match the given list.

parameters:
  - name: MFTFilename
    default: "C:/$MFT"

  - name: Accessor
    default: ntfs

  - name: filenameRegex
    type: hidden
    default: |
       Keyword
        a.exe
        b.exe
        c.exe
sources:
  - query: |
      LET keywords = SELECT Keyword from parse_csv(filename=filenameRegex, accessor="data")
      LET regex <= SELECT "(" + join(array=keywords.Keyword, sep="|") + ")" AS regex FROM scope()
      SELECT *, upload(file="C:/" + FullPath) AS Upload
        FROM parse_mft(filename=MFTFilename, accessor=Accessor)
        WHERE FileName =~ (regex[0]).regex