Added parsing of Visual Studio Code PowerShell history file

Visual Studio Code is very popular. The PowerShell history of it should be searched for credentials as well.
SnaffCon · Jul 11, 2024 · 04097d9 · 04097d9
1 parent ae01ab9
commit 04097d9
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/Snaffler/SnaffRules/DefaultRules/FileRules/Keep/Code/PowerShell/KeepPsByName.toml b/Snaffler/SnaffRules/DefaultRules/FileRules/Keep/Code/PowerShell/KeepPsByName.toml
@@ -13,5 +13,6 @@ Description = "Files with these exact names will be searched for PowerShell rela
 MatchLocation = "FileName"
 WordListType = "Exact"
 MatchLength = 0
-WordList = ["ConsoleHost_history\\.txt"]
-Triage = "Green"
+WordList = ["ConsoleHost_history\\.txt",
+"Visual Studio Code Host_history\\.txt"]
+Triage = "Green"