From ff47fa956013b8ecee34dc3f9434f1ff2cec3da2 Mon Sep 17 00:00:00 2001
From: kmanc <koins@duck.com>
Date: Thu, 24 Aug 2023 12:13:27 -0700
Subject: [PATCH] Update winPEAS.ps1

---
 winPEAS/winPEASps1/winPEAS.ps1 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/winPEAS/winPEASps1/winPEAS.ps1 b/winPEAS/winPEASps1/winPEAS.ps1
index b204235..c8a01ff 100644
--- a/winPEAS/winPEASps1/winPEAS.ps1
+++ b/winPEAS/winPEASps1/winPEAS.ps1
@@ -184,7 +184,7 @@ $regexSearch.add("Asana Client ID", "((asana[a-z0-9_ \.,\-]{0,25})(=|>|:=|\|\|:|
 $regexSearch.add("Atlassian API Key", "(atlassian[a-z0-9_ \.,\-]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['""]([a-z0-9]{24})['""]")
 $regexSearch.add("AWS Client ID", "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}")
 $regexSearch.add("AWS MWS Key", "amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}")
-$regexSearch.add("AWS Secret Key", "aws(.{0,20})?[0-9a-zA-Z\/+]{40}")
+$regexSearch.add("AWS Secret Key", "aws(.{0,20})?(\s)?(=)(\s)?[0-9a-zA-Z\/+]{40}")
 $regexSearch.add("AWS AppSync GraphQL Key", "da2-[a-z0-9]{26}")
 $regexSearch.add("Base32", "(?:[A-Z2-7]{8})*(?:[A-Z2-7]{2}={6}|[A-Z2-7]{4}={4}|[A-Z2-7]{5}={3}|[A-Z2-7]{7}=)?")
 $regexSearch.add("Base64", "(eyJ|YTo|Tzo|PD[89]|aHR0cHM6L|aHR0cDo|rO0)[a-zA-Z0-9+/]+={0,2}")