-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathscript.ps1
64 lines (49 loc) · 4.11 KB
/
script.ps1
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
Write-Host "
██▓ ██▀███ █ █░ ██▓▒███████▒ ▄▄▄ ██▀███ ▓█████▄
▓██▒▓██ ▒ ██▒ ▓█░ █ ░█░▓██▒▒ ▒ ▒ ▄▀░▒████▄ ▓██ ▒ ██▒▒██▀ ██▌
▒██▒▓██ ░▄█ ▒ ▒█░ █ ░█ ▒██▒░ ▒ ▄▀▒░ ▒██ ▀█▄ ▓██ ░▄█ ▒░██ █▌
░██░▒██▀▀█▄ ░█░ █ ░█ ░██░ ▄▀▒ ░░██▄▄▄▄██ ▒██▀▀█▄ ░▓█▄ ▌
░██░░██▓ ▒██▒ ░░██▒██▓ ░██░▒███████▒ ▓█ ▓██▒░██▓ ▒██▒░▒████▓
░▓ ░ ▒▓ ░▒▓░ ░ ▓░▒ ▒ ░▓ ░▒▒ ▓░▒░▒ ▒▒ ▓▒█░░ ▒▓ ░▒▓░ ▒▒▓ ▒
▒ ░ ░▒ ░ ▒░ ▒ ░ ░ ▒ ░░░▒ ▒ ░ ▒ ▒ ▒▒ ░ ░▒ ░ ▒░ ░ ▒ ▒
▒ ░ ░░ ░ ░ ░ ▒ ░░ ░ ░ ░ ░ ░ ▒ ░░ ░ ░ ░ ░
░ ░ ░ ░ ░ ░ ░ ░ ░ ░
░ ░
Author: Gary Hooks
Date: 15 April 2024
GitHub: https://github.com/garyhooks
***********************************************************************"
<# VARIABLE SET UP #>
$evidence_source = Read-Host -Prompt "Enter the drive letter where the evidence is hosted (e.g. H/M/R): [Default: H]"
if ([string]::IsNullOrWhiteSpace($Interesting)) {
$evidence_source = "H"
}
$output_directory= "D:\TESTINGSCRIPT"
$mytools = "D:\@gary_tools"
<#
# KAPE
Write-Host "[*] Running Kape..."
Write-Host "$mytools\kape\kape.exe --tsource ${evidence_source}: --tdest $output_directory $output_directory\ --tflush --target !SANS_Triage --vss"
Invoke-Expression -Command "$mytools\kape\kape.exe --tsource ${evidence_source}: --tdest $output_directory --tflush --target !SANS_Triage --vss"
# EvtxECmd: Put all event logs into single CSV
Write-Host `n"[*] Creating a single CSV file... "
Invoke-Expression -Command "$mytools\EvtxECmd\EvtxECmd.exe -d $output_directory\eventlogs\ --csv $output_directory\ --csvf all_eventlogs.csv"
# Hayabusa
Write-Host `n"[*] Running Hayabusa..."
Invoke-Expression -Command "$mytools\hayabusa-2.14.0-win-x64\hayabusa-2.14.0-win-x64.exe $hayabusa_directory update-rules"
Invoke-Expression -Command "$mytools\hayabusa-2.14.0-win-x64\hayabusa-2.14.0-win-x64.exe csv-timeline --directory $output_directory\${evidence_source}\Windows\System32\winevt\logs --output $output_directory\hayabusatimeline.csv --exclude-status deprecated,unsupported --min-level medium --no-wizard"
# Chainsaw
Write-Host `n"[*] Running Chainsaw now..."
Invoke-Expression -Command "$mytools\chainsaw\chainsaw_x86_64-pc-windows-msvc.exe hunt $output_directory\${evidence_source}\Windows\System32\winevt\logs -s $mytools\chainsaw\sigma\ --mapping $mytools\chainsaw\mappings\sigma-event-logs-all.yml -r $mytools\chainsaw\rules --csv --output $output_directory\chainsaw --skip-errors"
# Shimcache/AppComatCache
Write-Host `n"[*] Parsing Shimcache now..."
Invoke-Expression -Command "$mytools\AppCompatCacheParser.exe -f $output_directory\${evidence_source}\Windows\System32\config\SYSTEM -t --csv $output_directory\AppCompatCache\ --csvf shimcache.csv"
# Shimcache/Amcache
Write-Host `n"[*] Parsing Amcache now..."
Invoke-Expression -Command "$mytools\AmcacheParser.exe -f $output_directory\${evidence_source}\Windows\appcompat\Programs\Amcache.hve -i --csv $output_directory\AmCacheResults\ --csvf amcache.csv"
# Events Ripper: https://github.com/keydet89/Events-Ripper
Write-Host `n"[*] Running Events Ripper now..."
cd "$mytools\Events-Ripper\"
Invoke-Expression -Command "$mytools\Events-Ripper\wevtx.bat $output_directory\${evidence_source}\Windows\System32\winevt\logs\*.evtx $output_directory\all_eventlogs.txt"
Invoke-Expression -Command "$mytools\Events-Ripper\erip.exe -f $output_directory\all_eventlogs.txt -a" > $output_directory\event_ripper_results.csv
#>