$scriptVersion = "1.0.0"
$scriptDate = "2025-08-19"

# Display Script Banner
Write-Host "--------------------------------------------------" -ForegroundColor White
Write-Host "Windows IOC & Encryption Checker" -ForegroundColor Green
Write-Host "Version $($scriptVersion) ($($scriptDate))" -ForegroundColor Green
Write-Host "Written by Charlie Silverman" -ForegroundColor Green
Write-Host "--------------------------------------------------" -ForegroundColor White

Write-Host "Scanning for IOCs... " -NoNewLine
$fileList = @("crackmapexec", "kerbrute", "Anydesk", "IamBatMan", "stealer_cli_v2", "rclone", "nmap", "netscan", "mimikatz", "vmxojj", "zfewtu", "xigglo", "qfvtwz", "gkoou", "ofczqp", "videotomp3setup", "amd64.exe", "BaTrCk.exe", "232.bat", "tdsskiller.bat", "killdeff.bat", "logdel.bat", "bdfd47.lock", "processhacker.exe", "PCHunter64.exe", "win_locker.exe", "win_locker.ex_", "netscan.exe", "Syncovery.exe") 
$searchDirectory = "C:\"
$files = Get-ChildItem -Path $searchDirectory -Recurse -Include $fileList | Select-Object FullName, LastWriteTime
if ($files.Count -gt 0) {
	$files | Export-Csv -Path "C:\IOCScan.csv" -NoTypeInformation
	Write-Host "$($files.Count) matching files found." -ForegroundColor Yellow -BackgroundColor Red
	Write-Host "File list written to C:\IOCScan.csv"
} else {
	Write-Host "No IOCs found." -ForegroundColor Green
}
	
$drives = Get-PsDrive | Where-Object {$_.Root -like "?:\" -and $_.Used -gt 0} | Select-Object Root
foreach ($drive in $drives) {
	$dpath = $drive.Root
	Write-Host "Scanning drive $dpath for encrypted files.... " -NoNewLine
	$foundfiles = Get-ChildItem -Path $dpath -Recurse -Include "*akira*"
	if ($foundfiles.Count -gt 0) {
		$foundfiles | Export-Csv -Path "C:\EncryptedFiles-$($dpath[0]).csv"
		Write-Host "Found $($foundfiles.Count) encrypted files." -backgroundcolor Red -ForegroundColor Yellow
		Write-Host "Encrypted file list exported to C:\EncryptedFiles-$($dpath[0]).csv"
	} else {
		Write-Host "No encrypted files found" -ForegroundColor Green
	}
}