Powershell: IOC Detection with PowerShell
IoC Project:
Powershell for Helpdesk
Hello again friends, on this page you will see snippets that can probably help you on your day to day tasks. Again please always be vigilant with any code you run and where you run it, I am not liable for any problems or issues that may arise on your computer/s. that was my disclaimer, lol!
​
cls
function Pause ($Message="Press any key to continue..."){
""
Write-Host $Message
$null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}
function GetCompName{
$compname = Read-Host "Please enter a computer name or IP"
CheckHost
}
function CheckHost{
$ping = gwmi Win32_PingStatus -filter "Address='$compname'"
if($ping.StatusCode -eq 0){$pcip=$ping.ProtocolAddress; GetMenu}
else{Pause "Host $compname down...Press any key to continue"; GetCompName}
}
function GetMenu {
Clear-Host
" ########################"
" # Comp. Inf. Tool #"
" ########################"
" $compname ($pcip)"
""
""
"1) PC Serial Number"
"2) PC Printer Info"
"3) Current User"
"4) OS Info"
"5) System Info"
"6) Add/Remove Program List"
"7) Process List"
"8) Service List"
"9) USB Devices"
"10) Uptime"
"11) Disk Space"
"12) Memory Info"
"13) Processor Info"
"14) Check Hard Drive Health"
"15) Get Network Adapter/s Information"
"16) Send a message"
"17) Monitor Serial Numbers"
""
"C) Change Computer Name"
"X) Exit The program"
""
$MenuSelection = Read-Host "Enter Selection"
GetInfo
}
function GetInfo{
Clear-Host
switch ($MenuSelection){
1 { #PC Serial Number
gwmi -computer $compname Win32_BIOS | Select-Object SerialNumber | Format-List > C:\temp\PCinfo.txt
start-sleep -seconds 5
CheckHost
}
2 { #PC Printer Information
gwmi -computer $compname Win32_Printer | Select-Object DeviceID,DriverName, PortName | Format-List
start-sleep -seconds 5
CheckHost
}
3 { #Current User
gwmi -computer $compname Win32_ComputerSystem | Format-Table @{Expression={$_.Username};Label="Current User"}
""
#May take a very long time if on a domain with many users
#"All Users"
#"------------"
#gwmi -computer $compname Win32_UserAccount | foreach{$_.Caption}
start-sleep -seconds 10
CheckHost
}
4 { #OS Info
#Find out OS
Get-WmiObject Win32_OperatingSystem -ComputerName $n |
Select-Object CSName,Caption,CSDVersion,@{Label="InstallDate";Expression={[System.Management.ManagementDateTimeConverter]::
ToDateTime($($_.InstallDate))}},@{Label="LastBootUpTime";Expression={[System.Management.ManagementDateTimeConverter]::
ToDateTime($($_.LastBootUpTime))}},MUILanguages,OSArchitecture,ServicePackMajorVersion,Version
Write-Host $n -ForegroundColor black -BackgroundColor cyan | Out-GridView
Start-Sleep -Seconds 5
CheckHost
}
5 { #System Info
gwmi -computer $compname Win32_ComputerSystem | Format-List Name,Domain,Manufacturer,Model,SystemType
start-sleep -seconds 5
CheckHost
}
6 { #Add/Remove Program List
gwmi -computer $compname Win32_Product | Sort-Object Name | Format-Table Name,Vendor,Version
start-sleep -seconds 20
CheckHost
}
7 { #Process Listx
gwmi -computer $compname Win32_Process | Select-Object Caption,Handle | Sort-Object Caption | Format-Table
start-sleep -seconds 5
CheckHost
}
8 { #Service List
gwmi -computer $compname Win32_Service | Select-Object Name,State,Status,StartMode,ProcessID, ExitCode | Sort-Object Name | Format-Table
start-sleep -seconds 5
CheckHost
}
9 { #USB Devices
gwmi -computer $compname Win32_USBControllerDevice | %{[wmi]($_.Dependent)} | Select-Object Caption, Manufacturer, DeviceID | Format-List
start-sleep -seconds 5
CheckHost
}
10 { #Uptime
$wmi = gwmi -computer $compname Win32_OperatingSystem
$localdatetime = $wmi.ConvertToDateTime($wmi.LocalDateTime)
$lastbootuptime = $wmi.ConvertToDateTime($wmi.LastBootUpTime)
"Current Time: $localdatetime"
"Last Boot Up Time: $lastbootuptime"
$uptime = $localdatetime - $lastbootuptime
""
"Uptime: $uptime" >> C:\temp\PCinfo.txt
start-sleep -seconds 5
CheckHost
}
11 { #Disk Info
$wmi = gwmi -computer $compname Win32_logicaldisk
foreach($device in $wmi){
Write-Host "Drive: " $device.name
Write-Host -NoNewLine "Size: "; "{0:N2}" -f ($device.Size/1Gb) + " Gb"
Write-Host -NoNewLine "FreeSpace: "; "{0:N2}" -f ($device.FreeSpace/1Gb) + " Gb"
"" >> C:\temp\PCinfo.txt
}
start-sleep -seconds 5
CheckHost
}
12 { #Memory Info
$wmi = gwmi -computer $compname Win32_PhysicalMemory
foreach($device in $wmi) {
Write-Host "Bank Label: " $device.BankLabel #>> C:\temp\PCinfo.txt
Write-Host "Capacity: " ($device.Capacity/1MB) "Mb" #>> C:\temp\PCinfo.txt
Write-Host "Data Width: " $device.DataWidth #>> C:\temp\PCinfo.txt
Write-Host "Device Locator: " $device.DeviceLocator #>> C:\temp\PCinfo.txt
""
}
start-sleep -seconds 5
CheckHost
}
13 { #Processor Info
gwmi -computer $compname Win32_Processor | Format-List Caption,Name,Manufacturer,ProcessorId,NumberOfCores,AddressWidth #>> C:\temp\PCinfo.txt
start-sleep -seconds 10
CheckHost
}
#############################################################################################################################
14 { #Check Hard Drive Health
Get-PhysicalDisk | Sort Size | FT FriendlyName, Size, MediaType,
SpindleSpeed, HealthStatus, OperationalStatus -AutoSize #>> C:\temp\PCinfo.txt
start-sleep -seconds 5
CheckHost
}
#############################################################################################################################
15 { #Get Network Adapter/s Information
Get-WmiObject -ComputerName $n -Class Win32_NetworkAdapter | `Where-Object {$_.Speed -ne $null -and $_.MACAddress -ne $null } | `
Format-Table -Property SystemName,Name,MACAddress,NetConnectionID,Speed #>> C:\temp\PCinfo.txt
start-sleep -seconds 5
CheckHost
}
#############################################################################################################################
16 {#Send a message
# $msg = read-host "Enter your message "
# Invoke-WmiMethod -Path Win32_Process -Name Create -ArgumentList "msg * $msg" -ComputerName $n
Function remote_message{
$message = read-host -prompt 'Enter the message';
Invoke-WmiMethod -Class win32_process -ComputerName $compname -Name create -ArgumentList "c:\windows\system32\msg.exe * $message" }
remote_message
CheckHost
#Wait-Event -SourceIdentifier "ProcessStarted" -Timeout 90
}
#############################################################################################################################
17 { #Monitor Info
#Turn off Error Messages
$ErrorActionPreference_Backup = $ErrorActionPreference
$ErrorActionPreference = "SilentlyContinue"
$keytype=[Microsoft.Win32.RegistryHive]::LocalMachine
if($reg=[Microsoft.Win32.RegistryKey]::OpenRemoteBaseKey($keytype,$compname)){
#Create Table To Hold Info
$montable = New-Object system.Data.DataTable "Monitor Info"
#Create Columns for Table
$moncol1 = New-Object system.Data.DataColumn Name,([string])
$moncol2 = New-Object system.Data.DataColumn Serial,([string])
$moncol3 = New-Object system.Data.DataColumn Ascii,([string])
#Add Columns to Table
$montable.columns.add($moncol1)
$montable.columns.add($moncol2)
$montable.columns.add($moncol3)
$regKey= $reg.OpenSubKey("SYSTEM\\CurrentControlSet\\Enum\DISPLAY" )
$HID = $regkey.GetSubKeyNames()
foreach($HID_KEY_NAME in $HID){
$regKey= $reg.OpenSubKey("SYSTEM\\CurrentControlSet\\Enum\\DISPLAY\\$HID_KEY_NAME" )
$DID = $regkey.GetSubKeyNames()
foreach($DID_KEY_NAME in $DID){
$regKey= $reg.OpenSubKey("SYSTEM\\CurrentControlSet\\Enum\\DISPLAY\\$HID_KEY_NAME\\$DID_KEY_NAME\\Device Parameters" )
$EDID = $regKey.GetValue("EDID")
foreach($int in $EDID){
$EDID_String = $EDID_String+([char]$int)
}
#Create new row in table
$monrow=$montable.NewRow()
#MonitorName
$checkstring = [char]0x00 + [char]0x00 + [char]0x00 + [char]0xFC + [char]0x00
$matchfound = $EDID_String -match "$checkstring([\w ]+)"
if($matchfound){$monrow.Name = [string]$matches[1]} else {$monrow.Name = '-'}
#Serial Number
$checkstring = [char]0x00 + [char]0x00 + [char]0x00 + [char]0xFF + [char]0x00
$matchfound = $EDID_String -match "$checkstring(\S+)"
if($matchfound){$monrow.Serial = [string]$matches[1]} else {$monrow.Serial = '-'}
#AsciiString
$checkstring = [char]0x00 + [char]0x00 + [char]0x00 + [char]0xFE + [char]0x00
$matchfound = $EDID_String -match "$checkstring([\w ]+)"
if($matchfound){$monrow.Ascii = [string]$matches[1]} else {$monrow.Ascii = '-'}
$EDID_String = ''
$montable.Rows.Add($monrow)
}
}
$montable | select-object -unique Serial,Name,Ascii | Where-Object {$_.Serial -ne "-"} | Format-Table # >> C:\temp\PCinfo.txt
} else {
Write-Host "Access Denied - Check Permissions"
}
$ErrorActionPreference = $ErrorActionPreference_Backup #Reset Error Messages >> C:\temp\PCinfo.txt
start-sleep -seconds 5
CheckHost
}
1337 { Write-Host "updated by Gquezad)";Pause; CheckHost}
c {Clear-Host;$compname="";GetCompName}
x {Clear-Host; exit}
default{CheckHost}
}
}
#---------Start Main--------------
$compname = $args[0]
if($compname){CheckHost}
else{GetCompName}
​
