add exports when creating profile for windows shellcode

Added ps detection for Faronics Anti-Executable processes

client/command/generate/generate.go

@@ -291,6 +291,13 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 	sgnEnabled := false
 
 	var exports []string
+	exportsArg, _ := cmd.Flags().GetString("exports")
+	if exportsArg == "" {
+		con.PrintErrorf("Shared libraries need at least one export\n")
+		return "", nil
+	} else {
+		exports = strings.Split(exportsArg, ",")
+	}
 
 	format, _ := cmd.Flags().GetString("format")
 	runAtLoad := false
@@ -302,13 +309,6 @@ func parseCompileFlags(cmd *cobra.Command, con *console.SliverClient) (string, *
 		configFormat = clientpb.OutputFormat_SHARED_LIB
 		isSharedLib = true
 		runAtLoad, _ = cmd.Flags().GetBool("run-at-load")
-		exportsArg, _ := cmd.Flags().GetString("exports")
-		if exportsArg == "" {
-			con.PrintErrorf("Shared libraries need at least one export\n")
-			return "", nil
-		} else {
-			exports = strings.Split(exportsArg, ",")
-		}
 	case "shellcode":
 		configFormat = clientpb.OutputFormat_SHELLCODE
 		isShellcode = true

client/command/processes/ps.go

@@ -105,6 +105,8 @@ var knownSecurityTools = map[string][]string{
 	"cyuserservice.exe":               {console.Red, "Palo Alto Cortex"},             // Cortex XDR - user service
 	"cywscsvc.exe":                    {console.Red, "Palo Alto Cortex"},             // Cortex XDR - security center service
 	"tlaworker.exe":                   {console.Red, "Palo Alto Cortex"},             // Cortex XDR - local analysis worker
+	"AEEngine.exe":                    {console.Red, "Faronics Anti-Executable"},     // Faronics Anti-Executable - security service
+	"Antiexecutable.exe":              {console.Red, "Faronics Anti-Executable"},     // Faronics Anti-Executable - gui and tray icon
 }
 
 // PsCmd - List processes on the remote system

server/rpc/rpc-generate.go

@@ -709,6 +709,10 @@ func (rpc *Server) GenerateStage(ctx context.Context, req *clientpb.GenerateStag
 		return nil, err
 	}
 
+	if len(profile.Config.Exports) == 0 {
+		profile.Config.Exports = []string{"StartW"}
+	}
+
 	// generate config
 	build, err := generate.GenerateConfig(name, profile.Config)
 	if err != nil {