Everyday Powershell - Part 25 - Monitor for CryptoWall

So the bastards got us! Yup we got Cryptowalled!

We caught the infection before it did too much damage, isolated the PC, configured the firewall to block the IPs it was trying to get to and restored the pwnd files from backup. Business as usual really.

But what do we do to monitor for this in the future?

Whacked this together quickly;

$protectedpaths = "\\server1\someshare", "\\server2\someother" $filename = "-Canary-.txt" $foldername = "\-----AAA--TOP-----\" $canarystring = "If this can be read everything is ok" $logpath = "C:\scripts\cryptolockercanary.txt" $recipients = "someadmin@mail.com" $smtpserver = "somemailserver" $report = @() foreach ($path in $protectedpaths){     $temp = "" | select Time, Path, EncryptedStatus     $pathwithfolder =  $path + $foldername     $canarypath =  $pathwithfolder + $filename     $temp.time = get-date     $temp.path = $pathwithfolder     if (test-path $canarypath){         $test = Get-content $canarypath         if ($test -eq $canarystring){             $temp.EncryptedStatus = $false         }         else{             $temp.EncryptedStatus = $true             Send-MailMessage -to $recipients -From some@email.com  -Subject ("CryptoLockerCanary Has been changed! " + $temp.time) -BodyAsHtml ($temp | convertto-html | Out-String) -SmtpServer $smtpserver         }     }     else{         mkdir $pathwithfolder         out-file $canarypath -InputObject $canarystring         Set-ItemProperty -Path $canarypath -Name attributes -Value ((Get-ItemProperty $canarypath).attributes -BXOR ([io.fileattributes]::Hidden))         if (test-path $canarypath){             Send-MailMessage -to $recipients -From some@email.com  -Subject ("CryptoLockerCanary file is not present - creating new one " + $temp.time) -BodyAsHtml ($temp | convertto-html | Out-String) -SmtpServer $smtpserver         }         else{             Send-MailMessage -to $recipients -From some@email.com -Subject ("CryptoLockerCanary file is not present and COULD NOT CREATE new one - Recomend investigation " + $temp.time) -BodyAsHtml ($temp | convertto-html | Out-String) -SmtpServer $smtpserver         }     }     $report += $temp } $report | export-csv -Path $logpath -Append -NoTypeInformation $report

It'll take any folders defined in $protectedpaths and stick a "canary" file in there. If it sees a change to the canary file it'll send out emails to $recipients.

This is scheduled to run every five minutes so this way we'll get alerted really quickly if it get's through again.

Game Design brings out my evil side

Mwuhahahahahahaha!

Believe it or not... This is a Racing Game.

Island-Test6 a smooshing together of unity, world machine and some custom car scripts has allowed me to indulge in much deviousness.

What is the fine line between fun challenge and pure frustration? Well I don't know, but I'm trying my damnedest to find out!

Everyday Powershell - Part 24 - Send Email With Inline Image

Ever wanted to include inline images with an email you are sending out from a script?

We came across the requirement during our Exchange 2013 Migration.

This was ridiculously easy to achieve in Powershell 4.

Send-MailMessage -to someuser@someserver.com -From someotheruser@someserver.com -SmtpServer somemailserver -Subject "Test" -BodyAsHtml "TEST <br /><img src="attachement.png" />" -Attachments "C:\Scripts\attachement.png"

This is how we used to do it!

Add-PSSnapin Microsoft.Exchange.Management.Powershell.Admin -erroraction silentlyContinue $smtpServer = "somemailserver" $att = new-object Net.Mail.Attachment("c:\scripts\attachment.png") $att.ContentId = "att" $msg = new-object Net.Mail.MailMessage $smtp = new-object Net.Mail.SmtpClient($smtpServer) $body = "Some Text<br /> <img src="cid:att" />" $msg.From = "someuser@manly.nsw.gov.au" $msg.To.Add("someotheruser@manly.nsw.gov.au") $msg.Subject = "Some Subject" + (get-date -format yyyyMMdd) $msg.Body = $body $msg.IsBodyHTML = $true $msg.Attachments.Add($att) $smtp.Send($msg) $att.Dispose()

UPDATE - The HTML included in the script bugged out... Will fix shortly.

UPDATE 2 - reader sivaramsharma asked if send-mailmessage could handle multiple attachments, if this interests you too head over to Part 31 where we give a useful example.

Everyday Powershell - Part 23 - Check for old servers

Another simple AD cleanup script. But it's the simple things in life that count right?

You can run this script and it'll find any servers in your domain. It pings them and if they reply it sets .there to true otherwise it'll be null.

$servers = Get-ADComputer -filter {OperatingSystem -like "*Server*"} $report = @() foreach ($server in $servers) {     $temp = "" | select Name, There     $temp.name = $server.DNSHostName     $temp.there = if(Test-Connection $server.DNSHostName -Count 1){$true}     $report += $temp } $report

Quick and dirty powershell to do something useful in a hurry. That's what we're all about here!

Oh Irony

Crash reporter crashed would you like to report this crash?

It's stuff like this that makes working in IT a comedy gold mine for those working in IT.

Everyday Powershell - Part 22 - Determine which mailboxes a user has fullaccess to

Had cause this week to figure out to which mailboxes a particular user had been assigned Full Access  permission.

Seemed a bit daunting, and would have taken us ages to audit just using the GUI. But it was actually very quick to get going in Powershell.

Add-PSSnapin *exchange* $user = "TESTUSER" $mailboxes = get-mailbox foreach ($mailbox in $mailboxes) {     $mailboxpermission = Get-Mailboxpermission $mailbox     foreach ($permission in $mailboxpermission)     {         $permission | where {$_.Accessrights -Contains "FullAccess" -and $_.user -like "*$user*"} | select Identity     } }

This was a cracking use of Powershell right in the nick of time and made us seem really professional to our big boss. Really can't recommend enough getting some powershell tools into your frequently used toolbelt.

Once you start using it, it's amazing the things you start to dream up. Things you wouldn't have even thought to do before learning the power of the shell!

New rig is online!

Parts arrived by courier this morning...

Was planning to wait for the weekend to do the build. But being the passionate hardware enthusiast that I am, I couldn't wait. So I took a long lunch around at Kaggies shop and got to work.

The motherboard was in and out a few times to fit parts that I'd forgotten to mount. 

Doing the build in a proper work space was tops! Chris has all sorts of handy tools!

Mounting that water cooling system had me scratching my head for a while. Pretty sure I've done it wrong too. Might have a look a that manual again when I have a minute. I feel like there should be another Fan in the mix.

Builds always look so good right before the cables go in, don't they?

All done! All up it was about 2 hours including the Windows 8.1 install which was about 10 minutes! It's so fast and so Quiet. The Graphics card will change the sound profile quite a lot but we've got some plans for that too!