# three functions that produce filepath,Owner,Access,SDDL
# for the binaries listed by ps ("get-process")
# All rights reserved Ryan M. Ferris @ RMF Network Security
# Version r5:21 PM 9/6/2011
function Get-PSACL
{
ps | get-acl -ea 0 | Select pschildname,owner,AccessToString,Sddl
}
function Get-PEX
{
[array]$global:ps_list=ps
[array]$global:acl_list=$ps_list | get-acl -ea 0
$acl_list | Select @{label="FilePath"; Expression={ls $_.PsPath}},Owner,AccessToString,Sddl
}
function Get-PIDACL
{
foreach ($id in $(ps))
{$id | Select Name,ID,
@{Label="Owner";Expression={get-acl $id.Path | % {$_.Owner}}},
@{Label="Access";Expression={get-acl $id.Path | % {$_.AccessToString}}},
@{Label="SDDL";Expression={get-acl $id.Path | % {$_.SDDL}}}
}
}
Get-PSACL
Get-PEX
Get-PIDACL