PowerShell ืืื ืึท ืคืขืจืื ืคึผืจืึธืกื ืึธืืึทืืืืฉืึทื ืืขืฆืืึทื ืืืึธืก ืืื ืึธืคื ืืขื ืืฆื ืืืจื ืืืืืข ืืึทืืืืึทืจืข ืืขืืืขืืึธืคึผืขืจืก ืืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืืขืจืืืื ืกืคึผืขืฉืึทืืึทืกืฅ.
ืืขืจ ืึทืจืืืงื ืืืขื ืืืกืงืืืืจื ืื ืึธืคึผืฆืืข ืคืื โโื ืืฆื PowerShell ืฆื ืจืืืึธืืืื ืืึทืืืขื ืืึทืื ืคืื ืกืืฃ ืืขืืืืกืขืก ืืืขื ืจืืกืคึผืึทื ืืื ื ืฆื ืืื ืคึฟืึธืจืืึทืฆืืข ืืืืขืจืืืื ืื ืกืึทืืึทื ืฅ. ืฆื ืืึธื ืืึธืก, ืืืจ ืืืขื ืืึทืจืคึฟื ืฆื ืฉืจืืึทืื ืึท ืฉืจืืคื ืืืึธืก ืืืขื ืืืืคื ืืืืฃ ืื ืกืืฃ ืืืื ืืื ืขืก ืืืขื ืืืื ืึท ืืืืืืื ืืึทืฉืจืืึทืืื ื ืคืื ืืขื ืฉืจืืคื.
function CSIRT{
param($path)
if ($psversiontable.psversion.major -ge 5)
{
$date = Get-Date -Format dd.MM.yyyy_hh_mm
$Computer = $env:COMPUTERNAME
New-Item -Path $path$computer$date -ItemType 'Directory' -Force | Out-Null
$path = "$path$computer$date"
$process = get-ciminstance -classname win32_process | Select-Object creationdate, processname,
processid, commandline, parentprocessid
$netTCP = Get-NetTCPConnection | select-object creationtime, localaddress,
localport, remoteaddress, remoteport, owningprocess, state
$netUDP = Get-NetUDPEndpoint | select-object creationtime, localaddress,
localport, remoteaddress, remoteport, owningprocess, state
$task = get-ScheduledTask | Select-Object author, actions, triggers, state, description, taskname|
where author -notlike '*ะะฐะนะบัะพัะพัั*' | where author -ne $null |
where author -notlike '*@%systemroot%*' | where author -notlike '*microsoft*'
$job = Get-ScheduledJob
$ADS = get-item * -stream * | where stream -ne ':$Data'
$user = quser
$runUser = Get-ItemProperty "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
$runMachine = Get-ItemProperty "HKLM:SoftwareMicrosoftWindowsCurrentVersionRun"
$array = $process, $netTCP, $netUDP, $task, $user, $runUser, $runMachine, $job, $ADS
$arrayName = "Processes", "TCPConnect", "UDPConnect", "TaskScheduled", "Users", "RunUser", "RunMachine",
"ScheduledJob", "AlternativeDataStream"
for ($w = 0; $w -lt $array.count; $w++){
$name = $arrayName[$w]
$array[$w] >> $path$name.txt
}
}
}ืฆื ืึธื ืืืืื, ืฉืึทืคึฟื ืึท ืคึฟืื ืงืฆืืข CSIRT ืคืึทืจืืขื ืืขืจืื ื, ืืืึธืก ืืืขื ื ืขืืขื ืึทื ืึทืจืืืืขื ื - ืืขืจ ืืจื ืฆื ืจืึทืืขืืืขื ืื ืืืงืืืขื ืืึทืื. ืจืขืื ืฆื ืืขื ืคืึทืงื ืึทื ืจืืึฟ ืงืืืืขืฅ ืึทืจืืขื ืืื Powershell v5, ืื PowerShell ืืืขืจืกืืข ืืื ืึธืคึผืืขืฉืืขืื ืคึฟืึทืจ ืจืืืืืง ืึธืคึผืขืจืึทืฆืืข.
function CSIRT{
param($path)# ะฟัะธ ะทะฐะฟััะบะต ัะบัะธะฟัะฐ ะฝะตะพะฑั
ะพะดะธะผะพ ัะบะฐะทะฐัั ะดะธัะตะบัะพัะธั ะดะปั ัะพั
ัะฐะฝะตะฝะธั
if ($psversiontable.psversion.major -ge 5)ืคึฟืึทืจ ืื ืคืื ื ืึทืืืืืึทืฆืืข ืืืจื ืื ืืืฉืืคื ืืขืงืขืก, ืฆืืืื ืืืขืจืืึทืืึทืื ืืขื ืขื ืื ืืืืึทืืืืื: $ ืืึทืืข ืืื $ ืงืึธืืคึผืืืืขืจ, ืืืึธืก ืืืขื ืืืื ืึทืกืืื ื ืื ืงืึธืืคึผืืืืขืจ ื ืึธืืขื ืืื ืื ืงืจืึทื ื ืืึทืืข.
$date = Get-Date -Format dd.MM.yyyy_hh_mm
$Computer = $env:COMPUTERNAME
New-Item -Path $path$computer$date โItemType 'Directory' -Force | Out-Null
$path = "$path$computer$date"ืืืจ ืืึทืงืืืขื ืื ืจืฉืืื ืคืื ืคืืืกื ืืืง ืคึผืจืึทืกืขืกืึทื ืืืืฃ ืืืืึทืฃ ืคืื ืืขื ืงืจืึทื ื ืืึทื ืืฆืขืจ ืืื ืืืื: ืฉืึทืคึฟื ืึท $ ืคึผืจืึธืฆืขืก ืืืขืจืืึทืืึทืื, ืึทืกืืื ืื ื ืขืก ืื get-ciminstance cmdlet ืืื ืื win32_process ืงืืึทืก. ื ืืฆื ืื ืกืขืืขืงื-ืึธืืืืฉืขืงื ืงืืืืขื, ืืืจ ืงืขื ืขื ืืืืื ื ืึธื ืจืขืืืืืึทื ืคึผืึทืจืึทืืขืืขืจืก, ืืื ืืื ืืืขืจ ืคืึทื ืื ืืืขื ืืืื ืคึผืึทืจืขื ืืคึผืจืึธืกืขืกืกืื (ืคืึธืืขืจ ืคึผืจืึธืฆืขืก ืฉืืึทื PPID), ืงืจืขืึทืืืึธื ืืึทืืข (ืคึผืจืึธืกืขืก ืฉืึทืคืื ื ืืึทืืข), ืคึผืจืึทืกืขืกื (ืคึผืจืึธืกืขืก ืฉืืึทื PID), ืคึผืจืึทืกืขืกื ืึทืืข (ืคึผืจืึธืฆืขืก ื ืึธืืขื), ืงืึธืืืึทื ืืืื ืข ( ืืืืคื ืืึทืคึฟืขื).
$process = get-ciminstance -classname win32_process | Select-Object creationdate, processname, processid, commandline, parentprocessidืฆื ืืึทืงืืืขื ืึท ืจืฉืืื ืคืื ืึทืืข TCP ืืื UDP ืงืึทื ืขืงืฉืึทื ื, ืฉืึทืคึฟื ืื $ NETTCP ืืื $ NETUDP ืืืขืจืืึทืืึทืื ืืืจื ืึทืกืืื ืื ื ืืื ืื Get-NetTCPConnection ืืื Get-NetTCPConnection ืงืืืืขืฅ ืจืืกืคึผืขืงืืืืืื.
$netTCP = Get-NetTCPConnection | select-object creationtime, localaddress, localport, remoteaddress, remoteport, owningprocess, state
$netUDP = Get-NetUDPEndpoint | select-object creationtime, localaddress, localport, remoteaddress, remoteport, owningprocess, stateืขืก ืืืขื ืืืื ืืืืืืืง ืฆื ืืขืคึฟืื ืขื ืื ืจืฉืืื ืคืื ืคึผืืึทื ื ืขื ืืึทืกืงืก ืืื ืึทืกืืื ืืึทื ืฅ. ืฆื ืืึธื ืืึธืก, ืืืจ ื ืืฆื ืื ืงืืืืขืฅ Get-ScheduledTask ืืื Get-ScheduledJob. ืืื ืก ืืึทืฉืืืืขื ืืื ืื ืืืขืจืืึทืืึทืื $ ืืึทืกืง ืืื $ ืึทืจืืขื, ืืืืึทื ืืืืืขืก, ืขืก ืืขื ืขื ืึท ืคึผืืึทืฅ ืคืื ืกืงืขืืืฉืืื ืืึทืกืงืก ืืื ืื ืกืืกืืขื, ืืื ืืื ืกืืจ ืฆื ืืืขื ืืืคืืฆืืจื ืืืืืข ืึทืงืืืืืืืขืื, ืขืก ืืื ืืืขืจื ืคืืืืขืจืื ื ืืึทืืืฉืืืึทืืึทื ืกืงืขืืืฉืืื ืืึทืกืงืก. ืื ืกืขืืขืงื-ืึธืืืืฉืขืงื ืงืืืืขื ืืืขื ืืขืืคึฟื ืืื ืื ืืื ืืขื.
$task = get-ScheduledTask | Select-Object author, actions, triggers, state, description, taskname| where author -notlike '*ะะฐะนะบัะพัะพัั*' | where author -ne $null | where author -notlike '*@%systemroot%*' | where author -notlike '*microsoft*' # $task ะธัะบะปััะฐะตั ะฐะฒัะพัะพะฒ, ัะพะดะตัะถะฐัะธั
โะะฐะนะบัะพัะพััโ, โMicrosoftโ, โ*@%systemroot%*โ, ะฐ ัะฐะบะถะต ยซะฟััััั
ยป ะฐะฒัะพัะพะฒ
$job = Get-ScheduledJobืืื ืื NTFS ืืขืงืข ืกืืกืืขื ืขืก ืืื ืึทืืึท ืึท ืืึทื ืืื ืึธืืืขืจื ืึทืืืื ืืึทืื ืกืืจืืื (ืึทืืก). ืืขื ืืืื ืึทื ืึท ืืขืงืข ืืื NTFS ืงืขื ืขื ืึธืคึผืืืึธื ืึทืืื ืืืื ืคืืจืืื ืื ืืื ืงืืืคื ืืึทืื ืกืืจืืื ืคืื ืึทืจืืืืจืึทืจืืฉ ืืจืืืก. ืืื ืึทืืก, ืืืจ ืงืขื ืขื ืืึทืืึทืืื ืืึทืื ืืืึธืก ืืืึธืื ื ืื ืืืื ืงืขื ืืืง ืืืจื ื ืึธืจืืึทื ืกืืกืืขื ืืฉืขืงืก. ืืึธืก ืืืื ืขืก ืืขืืืขื ืฆื ืึทืจืืึทื ืฉืคึผืจืืฆื ืืืืืข ืงืึธื ืืื / ืึธืืขืจ ืืึทืืึทืืื ืืึทืื.
ืฆื ืืืืึทืื ืึธืืืขืจื ืึทืืืื ืืึทืื ืกืืจืืื ืืื PowerShell, ืืืจ ืืืขืื ื ืืฆื ืื ืืึทืงืืืขื-ื ืืฅ ืงืืืืขื ืืื ืื ืืขืืืื-ืืื Windows ืกืืจืื ืืขืฆืืึทื ืืื ืื * ืกืืืืึธื ืฆื ืืขื ืึทืืข ืืขืืืขื ืกืืจืืื, ืคึฟืึทืจ ืืขื ืืืจ ืืืขืื ืืึทืื ืื $ADS ืืืึทืืขืืืืืง.
$ADS = get-item * -stream * | where stream โne ':$Data' ืขืก ืืืขื ืืืื ื ืืฆืืง ืฆื ืืขืคึฟืื ืขื ืื ืจืฉืืื ืคืื ืืืืขืจื ืืึธืื ืืื ืื ืกืืกืืขื; ืคึฟืึทืจ ืืขื ืืืจ ืืืขืื ืฉืึทืคึฟื ืึท $ ืืึทื ืืฆืขืจ ืืืึทืืขืืืืืง ืืื ืืึทืฉืืืืขื ืขืก ืฆื ืืขืจ ืืืจืืคืืจืื ื ืคืื ืื ืงืืืกืขืจ ืคึผืจืึธืืจืึทื.
$user = quser
ืึทืืึทืงืขืจื ืงืขื ืขื ืืึทืื ืขื ืืขืจืื ืืขื ืฆื ืึทืืืึธืจืื ืฆื ืืึทืงืืืขื ืึท ืคืืืืึธืืื ืืื ืื ืกืืกืืขื. ืฆื ืืขื ืกืืึทืจืืึทืคึผ ืึทืืืืฉืขืงืฅ, ืืืจ ืงืขื ืขื ื ืืฆื ืื Get-ItemProperty ืงืืืืขื.
ืืึธืืืจ ืืึทืื ืฆืืืื ืืืขืจืืึทืืึทืื: $runUser - ืฆื ืืขื ืกืืึทืจืืึทืคึผ ืืืืฃ ืืืืึทืฃ ืคืื ืื ืืึทื ืืฆืขืจ ืืื $runMachine - ืฆื ืืขื ืกืืึทืจืืึทืคึผ ืคึฟืึทืจ ืื ืงืึธืืคึผืืืืขืจ.
$runUser = Get-ItemProperty
"HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
$runMachine = Get-ItemProperty
"HKLM:SoftwareMicrosoftWindowsCurrentVersionRun"ืึทืืื ืึทื ืึทืืข ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืืขืฉืจืืื ืฆื ืคืึทืจืฉืืืขื ืข ืืขืงืขืก, ืืืจ ืืึทืื ืึท ืืขื ืืข ืืื ืืืขืจืืึทืืึทืื ืืื ืึท ืืขื ืืข ืืื ืืขืงืข ื ืขืืขื.
$array = $process, $netTCP, $netUDP, $task, $user, $runUser, $runMachine, $job, $ADS
$arrayName = "Processes", "TCPConnect", "UDPConnect" "TaskScheduled", "Users", "RunUser", "RunMachine",
"ScheduledJob", "Alternative Data Stream"ืืื ื ืืฆื ืึท ืคึฟืึทืจ ืฉืืืืฃ, ืื ืืืงืืืขื ืืึทืื ืืืขื ืืืื ืืขืฉืจืืื ืฆื ืืขืงืขืก.
for ($w = 0; $w -lt $array.count; $w++){
$name = $arrayName[$w]
$array[$w] >> $path$name.txt
ื ืึธื ืขืงืกืึทืงืืืืื ื ืื ืฉืจืืคื, 9 ืืขืงืกื ืืขืงืขืก ืืืขื ืืืื ืืืฉืืคื ืืื ืื ื ืืืืืง ืืื ืคึฟืึธืจืืึทืฆืืข.
ืืืึทื ื, ืกืืืืขืจืกืขืงืืจืืื ืคึผืจืึธืคืขืกืกืืึธื ืึทืืก ืงืขื ืขื ื ืืฆื PowerShell ืฆื ืืึทืจืืึทืืขืจื ืื ืืื ืคึฟืึธืจืืึทืฆืืข ืืื ืืึทืจืคึฟื ืฆื ืกืึธืืืืข ืึท ืคืึทืจืฉืืืื ืงืืึทื ืคืื ืืึทืกืงืก ืืื ืืืืขืจ ืึทืจืืขื. ืืืจื ืึทืืื ื ืึท ืฉืจืืคื ืฆื ืกืืึทืจืืึทืคึผ, ืืืจ ืงืขื ืขื ืืึทืงืืืขื ืขืืืขืืข ืืื ืคึฟืึธืจืืึทืฆืืข ืึธื ืจืืืืืืื ื ืืึทืืคึผืก, ืืืืืขืจ, ืขืืง.
ืืงืืจ: www.habr.com