Variables

The collector replaced all ${VAR_NAME} variables with the actual values during the execution.

You can use variables in the following places:

1. All string values (including lists) in the actions section
2. All string values in the custom_command section of the launch_conditions section

Example:

  - name: memory_dump
    type: binary
    attributes:
      path: "winpmem_mini_${ARCH}.exe"
      args: ["${LOOT_DIR}\\${DEVICE_NAME}.dmp"]

Available Variables