API tools faq
paste
Advertisement
Guest User

PS porject 1

a guest
Jan 17th, 2019
82
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
PowerShell 3.54 KB | None | 0 0
raw download clone embed print report
  1. #Prepare baseline
  2. pause
  3. Get-ItemProperty -Path "Registry::\HKLM\Software\Microsoft\Windows\CurrentVersion\Run" | out-file HKLM_Run1.txt
  4. Get-ItemProperty -Path "Registry::\HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-File HKLM_RunOnce1.txt
  5. Get-ItemProperty -path "Registry::\HKCU\Software\Microsoft\Windows\CurrentVersion\Run" | Out-File HKCU_Run1.txt
  6. Get-ItemProperty -path "Registry::\HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-File HKCU_RunOnce1.txt
  7. Get-ChildItem -Path "Registry::\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" -Recurse | Out-File HKLM_ProfileList1.txt
  8. Get-ItemProperty -Path "Registry::\HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks" | Out-File HKLM_Task1.txt
  9. Get-ItemProperty -Path "Registry::\HKLM\SYSTEM\CurrentControlSet\SERVICES" | Out-File HKLM_Services1.txt
  10. Get-ItemProperty -Path "Registry::\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" | Out-File HKLM_NetProfiles1.txt
  11. Get-ItemProperty -Path "Registry::\HKCU\Software\Microsoft\Internet Explorer\TypedURLs" | Out-File HKCU_IE1.txt
  12. pause
  13.  
  14. #run after malware install
  15.  
  16. pause
  17.  
  18. #Prepare Second Look
  19. pause
  20. Get-ItemProperty -Path "Registry::\HKLM\Software\Microsoft\Windows\CurrentVersion\Run" | out-file HKLM_Run2.txt
  21. Get-ItemProperty -Path "Registry::\HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-File HKLM_RunOnce2.txt
  22. Get-ItemProperty -path "Registry::\HKCU\Software\Microsoft\Windows\CurrentVersion\Run" | Out-File HKCU_Run2.txt
  23. Get-ItemProperty -path "Registry::\HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-File HKCU_RunOnce2.txt
  24. Get-ChildItem -Path "Registry::\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" -Recurse | Out-File HKLM_ProfileList2.txt
  25. Get-ItemProperty -Path "Registry::\HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\Taskcache\Tasks"  | Out-File HKLM_Task2.txt
  26. Get-ItemProperty -Path "Registry::\HKLM\SYSTEM\CurrentControlSet\SERVICES\" | Out-File HKLM_Services2.txt
  27. Get-ItemProperty -Path "Registry::\HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles" | Out-File HKLM_NetProfiles2.txt
  28. Get-ItemProperty -Path "Registry::\HKCU\Software\Microsoft\Internet Explorer\TypedURLs" | Out-File HKCU_IE2.txt
  29. pause
  30.  
  31. #Compare Files
  32. pause
  33. #Compare HKLM_Run Files
  34. Compare-Object -ReferenceObject (Get-Content HKLM_Run1.txt) -DifferenceObject (Get-Content HKLM_Run2.txt)
  35. #Compare HKLM_RunOnce Files
  36. Compare-Object -ReferenceObject (Get-Content HKLM_RunOnce1.txt) -DifferenceObject (Get-Content HKLM_RunOnce2.txt)
  37. #Compare HKCU_Run Files
  38. Compare-Object -ReferenceObject (Get-Content HKCU_Run1.txt) -DifferenceObject (Get-Content HKCU_Run2.txt)
  39. #Compare HKCU_RunOnce Files
  40. Compare-Object -ReferenceObject (Get-Content HKCU_RunOnce1.txt) -DifferenceObject (Get-Content HKCU_RunOnce2.txt)
  41. #Compare HKLM_ProfileList Files
  42. Compare-Object -ReferenceObject (Get-Content HKLM_ProfileList Files1.txt) -DifferenceObject (Get-Content HKLM_ProfileList Files2.txt)
  43. #Compare HKLM_Task Files
  44. Compare-Object -ReferenceObject (Get-Content .\HKLM_Task1.txt) -DifferenceObject (Get-Content HKLM_Task2.txt)
  45. #Compare HKLM_Services
  46. Compare-Object -ReferenceObject (Get-Content HKLM_Services1.txt) -DifferenceObject (Get-Content HKLM_Services2.txt)
  47. #Compare HKLM_NetProfile Files
  48. Compare-Object -ReferenceObject (Get-Content HKLM_NetProfiles1.txt) -DifferenceObject (Get-Content HKLM_NetProfiles2.txt)
  49. #Compare HKCU_IE Files
  50. Compare-Object -ReferenceObject (Get-Content HKCU_IE1.txt) -DifferenceObject (Get-Content HKCU_IE2.txt)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!