Using PowerShell for Incident Information Gathering

PowerShell is a widely used automation tool, often employed by both malware developers and information security specialists.
This article will explore how to use PowerShell for remote data collection from endpoint devices during incident response. To achieve this, you need to write a script that will run on the endpoint, and a detailed description of the script will follow.

function CSIRT{
param($path)
if ($psversiontable.psversion.major -ge 5)
	{
	$date = Get-Date -Format dd.MM.yyyy_hh_mm
	$Computer = $env:COMPUTERNAME
	New-Item -Path $path$computer$date -ItemType 'Directory' -Force | Out-Null
	$path = "$path$computer$date"

	$process = get-ciminstance -classname win32_process | Select-Object creationdate, processname,
	processid, commandline, parentprocessid

	$netTCP = Get-NetTCPConnection | select-object creationtime, localaddress,
	localport, remoteaddress, remoteport, owningprocess, state
	
	$netUDP = Get-NetUDPEndpoint | select-object creationtime, localaddress,
	localport, remoteaddress, remoteport, owningprocess, state

	$task = get-ScheduledTask | Select-Object author, actions, triggers, state, description, taskname|
	where author -notlike '*Microsoft*' | where author -ne $null |
	where author -notlike '*@%systemroot%*' | where author -notlike '*microsoft*'

	$job = Get-ScheduledJob

	$ADS = get-item * -stream * | where stream -ne ':$Data'

	$user = quser

	$runUser = Get-ItemProperty "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"

	$runMachine = Get-ItemProperty "HKLM:SoftwareMicrosoftWindowsCurrentVersionRun"

	$array = $process, $netTCP, $netUDP, $task, $user, $runUser, $runMachine, $job, $ADS
	$arrayName = "Processes", "TCPConnect", "UDPConnect", "TaskScheduled", "Users", "RunUser", "RunMachine",
	"ScheduledJob", "AlternativeDataStream"


	for ($w = 0; $w -lt $array.count; $w++){
		$name = $arrayName[$w]
		$array[$w] >> $path$name.txt
		}

	}

}

To get started, a function is created CSIRT, which will take an argument – the path for saving the collected data. Since most cmdlets work in PowerShell v5, a version check has been implemented for proper functioning.

function CSIRT{
		
param($path) # when running the script, the directory for saving must be specified
if ($psversiontable.psversion.major -ge 5)

For easier navigation through the created files, two variables are initialized: $date and $Computer, which will be assigned the computer name and the current date.

$date = Get-Date -Format dd.MM.yyyy_hh_mm
$Computer = $env:COMPUTERNAME
New-Item -Path $path$computer$date –ItemType 'Directory' -Force | Out-Null 
$path = "$path$computer$date"

To obtain a list of running processes for the current user, we will create a variable $process, assigning it the get-ciminstance cmdlet with the win32_process class. By using the Select-Object cmdlet, we can add additional parameters to be output, which in our case will include parentprocessid (the parent process identifier PPID), creationdate (the process creation date), processid (the process identifier PID), processname (the name of the process), and commandline (the command to launch).

$process = get-ciminstance -classname win32_process | Select-Object creationdate, processname, processid, commandline, parentprocessid

To get a list of all TCP and UDP connections, we will create variables $netTCP and $netUDP, assigning them the Get-NetTCPConnection and Get-NetUDPEndpoint cmdlets, respectively.

$netTCP = Get-NetTCPConnection | select-object creationtime, localaddress, localport, remoteaddress, remoteport, owningprocess, state

$netUDP = Get-NetUDPEndpoint | select-object creationtime, localaddress, localport, remoteaddress, remoteport, owningprocess, state

It will also be important to know the list of scheduled tasks and jobs. For this, we will use the get-ScheduledTask and Get-ScheduledJob cmdlets. We will assign them the variables $task and $job; since there are many scheduled tasks existing in the system, to identify any malicious activity, it is worth filtering out legitimate scheduled tasks. The Select-Object cmdlet will assist us with this.

$task = get-ScheduledTask | Select-Object author, actions, triggers, state, description, taskname | where author -notlike '*Microsoft*' | where author -ne $null | where author -notlike '*@%systemroot%*' | where author -notlike '*microsoft*' # $task excludes authors containing “Microsoft”, “*@%systemroot%*”, as well as “empty” authors
$job = Get-ScheduledJob

In the NTFS file system, there is a concept known as Alternate Data Streams (ADS). This means that a file in NTFS can additionally be linked with multiple data streams of arbitrary size. Using ADS, data can be hidden that will not be visible through standard system checks. This can allow for the embedding of malicious code and/or the concealment of information.

To output alternate data streams in PowerShell, we will use the get-item cmdlet and the built-in Windows stream tool with the * symbol to view all possible streams; for this, we will create a variable $ADS.

$ADS = get-item * -stream * | where stream –ne ':$Data' 

It will be useful to know the list of users logged into the system; for this, we will create a variable $user and assign it the execution of the quser program.

$user = quser

Malicious actors can embed themselves in the system by modifying the autostart. To view objects in autostart, you can use the Get-ItemProperty cmdlet.
Let's create two variables: $runUser – to view autostart on behalf of the user and $runMachine – to view autostart on behalf of the computer.

$runUser = Get-ItemProperty 
"HKCU:Software\Microsoft\Windows\CurrentVersion\Run"
$runMachine = Get-ItemProperty 
"HKLM:Software\Microsoft\Windows\CurrentVersion\Run"

To record all information in different files, we create an array with variables and an array with file names.

$array = $process, $netTCP, $netUDP, $task, $user, $runUser, $runMachine, $job, $ADS
$arrayName = "Processes", "TCPConnect", "UDPConnect", "TaskScheduled", "Users", "RunUser", "RunMachine",
"ScheduledJob", "Alternative Data Stream"

And, using a for loop, the obtained data will be written to the files.

for ($w = 0; $w -lt $array.count; $w++){
	$name = $arrayName[$w]
	$array[$w] >> $path$name.txt

After running the script, 9 text files will be created containing the necessary information.

Currently, cybersecurity specialists can use PowerShell to enrich the information needed when addressing various tasks in their work. By adding a script to autostart, some information can be obtained without taking dumps, images, etc.

Source: habr.com