Initial commit of more scripts
This commit is contained in:
1 parent
141a001806
commit
6b9468d796
6 files changed
+602
No files matched your search
@@ -0,0 +1,35 @@
|
||||
$scriptVersion = "1.0.0"
|
||||
$scriptDate = "2025-08-19"
|
||||
|
||||
# Display Script Banner
|
||||
Write-Host "--------------------------------------------------" -ForegroundColor White
|
||||
Write-Host "Windows IOC & Encryption Checker" -ForegroundColor Green
|
||||
Write-Host "Version $($scriptVersion) ($($scriptDate))" -ForegroundColor Green
|
||||
Write-Host "Written by Charlie Silverman" -ForegroundColor Green
|
||||
Write-Host "--------------------------------------------------" -ForegroundColor White
|
||||
|
||||
Write-Host "Scanning for IOCs... " -NoNewLine
|
||||
$fileList = @("crackmapexec", "kerbrute", "Anydesk", "IamBatMan", "stealer_cli_v2", "rclone", "nmap", "netscan", "mimikatz", "vmxojj", "zfewtu", "xigglo", "qfvtwz", "gkoou", "ofczqp", "videotomp3setup", "amd64.exe", "BaTrCk.exe", "232.bat", "tdsskiller.bat", "killdeff.bat", "logdel.bat", "bdfd47.lock", "processhacker.exe", "PCHunter64.exe", "win_locker.exe", "win_locker.ex_", "netscan.exe", "Syncovery.exe")
|
||||
$searchDirectory = "C:\"
|
||||
$files = Get-ChildItem -Path $searchDirectory -Recurse -Include $fileList | Select-Object FullName, LastWriteTime
|
||||
if ($files.Count -gt 0) {
|
||||
$files | Export-Csv -Path "C:\IOCScan.csv" -NoTypeInformation
|
||||
Write-Host "$($files.Count) matching files found." -ForegroundColor Yellow -BackgroundColor Red
|
||||
Write-Host "File list written to C:\IOCScan.csv"
|
||||
} else {
|
||||
Write-Host "No IOCs found." -ForegroundColor Green
|
||||
}
|
||||
|
||||
$drives = Get-PsDrive | Where-Object {$_.Root -like "?:\" -and $_.Used -gt 0} | Select-Object Root
|
||||
foreach ($drive in $drives) {
|
||||
$dpath = $drive.Root
|
||||
Write-Host "Scanning drive $dpath for encrypted files.... " -NoNewLine
|
||||
$foundfiles = Get-ChildItem -Path $dpath -Recurse -Include "*akira*"
|
||||
if ($foundfiles.Count -gt 0) {
|
||||
$foundfiles | Export-Csv -Path "C:\EncryptedFiles-$($dpath[0]).csv"
|
||||
Write-Host "Found $($foundfiles.Count) encrypted files." -backgroundcolor Red -ForegroundColor Yellow
|
||||
Write-Host "Encrypted file list exported to C:\EncryptedFiles-$($dpath[0]).csv"
|
||||
} else {
|
||||
Write-Host "No encrypted files found" -ForegroundColor Green
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user