The current "apptelem.pl", "failedlogins.pl", and "restarts.pl" plugins all appear to be busted.

[CmdrBurrito]

Something appears to be wrong with the "apptelem.pl", "failedlogins.pl", and "restarts.pl" plugins that have been uploaded into your "Events-Ripper" repository on GitHub.

After running a "git clone" against the current "Events-Ripper" repository, those three (3) specific plugin files appear to be filled with blank lines (or some other non-printable special character). When run on Windows, the command "erip.exe -l -c" returns errors when it hits those plugins as well. Lastly, attempting to view the source code for any of those plugins via the github website, appears to just return a bunch of the same repeating special characters (i.e., no source code is displayed).

Below is an example of "erip.exe -l -c" output on my machine:

PS C:\keydet89\Events-Ripper> .\erip.exe -l -c
Plugin,Version,Description
appissue,20230605,Parse Application Hang/Error events
Error: C:\keydet89\Events-Ripper\plugins\apptelem.pl did not return a true value at C:\keydet89\Events-Ripper\erip.exe line 65.

bitsclient,20230523,Gets info from BITS-Client/3 and /59 events
cleared,20230302,Check for EventLog cleared events
dcom10028,20220930,Parse DCOM/10028 events
defender,20230802,Parse multiple WinDefend events
Error: C:\keydet89\Events-Ripper\plugins\failedlogins.pl did not return a true value at C:\keydet89\Events-Ripper\erip.exe line 65.

filter,20230802,Parse Windows Filtering Platform events from Security.evtx
filtering,20230302,Parse filtering platform events
hitman,20220930,Parse HitmanPro.Alert/911 events
localsessionips,20230209,Parse LocalSessionManager events for IP addrs
logins,20230714,Parse Security-Auditing/4624 login events
mount,20221010,Get VHD[X]/ISO files mounted
msi,20230504,Parse MsiInstaller events
mssql,20230411,Parse MSSQL/18456 and ../15457 events
nssm,20230525,Parse nssm events
ntfs,20221010,Get NTFS volumes
osversion,20220930,Determine Windows version from EventLog/6009 events
pca,20220930,Gets info from Program Compat Asst Event Log
posh600,20230526,Parse Powershell/600 events for scripts
rdpcore140,20230203,Parse RdpCoreTS/140 events
Error: C:\keydet89\Events-Ripper\plugins\restarts.pl did not return a true value at C:\keydet89\Events-Ripper\erip.exe line 65.

s1,20220930,Parse SentinelOne/31 and /32 events
scm,20230802,Parse Service Control Manager events
sec4648,20220930,Parse Security-Auditing/4648 events
sec4688,20220930,Parse Security-Auditing/4688 events
sec4697,20220930,Parse Security-Auditing/4697 (service install) events
sec4797,20230504,Parse Security-Auditing/4797 (user account checked for blank passwd) events
sec4948,20220928,Parse Security-Auditing/4948 (firewall rule deletion) events
sec5381,20230605,Parse Security-Auditing/5381 (user enum. vault creds) events
sessions,20230307,Parse login/logoff events
shellcore,20220930,Get apps run via Run/RunOnce keys
timechange,20230601,Parse Security-Auditing/616 (system clock changed) events
tsgateway,20230209,Parse TSGateway events
usrmgr,20220930,Parse user mgmt events

Please advise if you have any questions. Regards!

[keydet89]

That's weird.

I'll see what I can about replacing those three from my local repo.

[keydet89]

Okay, try it now

[CmdrBurrito]

Yep, the problem appears to have be resolved. Many thanks!