Create Generic.Remediation.UploadFile.Glob.yaml

[Che4ter]

Create an artifact to upload a file to the target destination. If the target already exists, it will be overridden. The artefact uses the glob, so you can upload the file to multiple locations at once.

[CLAassistant]

All committers have signed the CLA.

[scudette]

Have you tested this actually stops it from overriding? I think it might be safer to just use an if() here:

if(condition = ReallyDoIt, then=copy(filename=UploadedFile.FullPath[0], accessor="file", dest=OSPath)) AS Overwritten

[Che4ter]

Yes it works fine. I used it multiple times during my last engagement. Most of the logic is copied from another artefact: https://docs.velociraptor.app/exchange/artifacts/pages/globremediation/

[scudette]

Its not really the same as that artifact - you can see in GlobRemediation the bottom query is

SELECT ...
      FROM if(condition=ReallyDoIt,
            then= delete_targets,
            else= { SELECT *, FALSE as Removed FROM targets } )

So depending on the condition it will choose a completely different query - one for delete and one for just showing.

But in this artifact it chooses the same query in both cases, it just replaces the column that removes with FALSE. This generally also works because VQL is generally lazy and wont evaluate a column that got replaced but it is quite fragile and potentially dangerous in this case.

[Che4ter]

Thanks for your explanations. I've changed it to an if statement and simplified the query a bit.