Powershell Zero Day Check Script

  #####################################################################
# Author:                                                  #
#  Date:   03/03/2021                                                   #
# Desc:   Parse exchange server logs to identify either of 4 exploits #
  #####################################################################
cls
#Global Variables
$To="<shared mailbox to receive report"
$i=0;$server=$env:COMPUTERNAME;$pf="D:\Program Files";$date=(get-date).AddDays(0).ToString("yyyyMMdd");$RowData=$null

#Check for exploits exchaneg logs for possible exploits to CVE-2021-26855
$CVE_26855=Import-Csv -Path (Get-ChildItem -Recurse -Path "$pf\Microsoft\Exchange Server\V15\Logging\HttpProxy\" -Filter "*$date*.log").FullName|?{$_.AuthenticatedUser -eq "" -and $_.AnchorMailbox -like ‘ServerInfo~*/*’ }|select DateTime,AnchorMailbox
if($CVE_26855 -ne $null){$th1="<tr><th>CVE-2021-26855</th></tr>";$rd1=$null;foreach($e in $CVE_26855){$rd1+="<tr><td>$e</td></tr>"};$RowData=$th1+$rd1;$i++}

#Check for an EventLog Application Source of "MSExchange Unified Messaging"
$els=(Get-EventLog -LogName Application).Source|select -Unique|sort
if($els -contains "MSExchange Unified Messaging") {$CVE_26857=Get-EventLog -LogName Application -Source "MSExchange Unified Messaging" -EntryType Error|?{ $_.Message -like "*System.InvalidCastException*" }}
#then run command (if condition is met) to check for exploits to CVE-2021-26857
if($CVE_26857 -ne $null){$th2="<tr><th>$null</th></tr><tr><th>CVE-2021-26857</th></tr>";$rd2=$null;foreach($e in $CVE_26857){$rd2+="<tr><td>$e</td></tr>"};$RowData=$RowData+$th2+$rd2;$i++}

#Check for exploits in exchange logs for possible exploits to CVE-2021-26858
$CVE_26858=findstr /snip /c:"Download failed and temporary file" "$pf\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog\*.log"
if($CVE_26858 -ne $null){$th3="<tr><th>$null</th></tr><tr><th>CVE-2021-26858</th></tr>";$rd3=$null;foreach($e in $CVE_26858){$rd3+="<tr><td>$e</td></tr>"};$RowData=$RowData+$th3+$rd3;$i++}

#Check for exploits in exchange logs for possible exploits to CVE-2021-27065
$CVE_27065=Select-String -Path “$pf\Microsoft\Exchange Server\V15\Logging\ECP\Server\*.log” -Pattern ‘Set-.+VirtualDirectory’
if($CVE_27065 -ne $null){$th4="<tr><th>$null</th></tr><tr><th>CVE-2021-27065</th></tr>";$rd4=$null;foreach($e in $CVE_27065){$rd4+="<tr><td>$e</td></tr>"};$RowData=$RowData+$th4+$rd4;$i++}

#Set up email variables
$SmtpSrvr="<your smtp server>";$From="<an existing mailbox that can send this message>"
$Sub="[SUBJECT] $server (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, CVE-2021-27065)"
$Bod1="<!DOCTYPE html><html><head></head><body>Team,<br><br>We have run the 0-Day Exploits check as suggested by Msf and found no issues!<br><br>Thank You,<br><br>Messaging</body></html>"
$Bod2="<!DOCTYPE html><html><head><style>table {font-family: arial, sans-serif; border-collapse: collapse; width: 100%;} td, th {text-align: left; padding: 5px;}</style></head>
        <body>Team,<br><br>We have run the 0-Day Exploits check as suggested by Msf and found the following issues:<br><br>
        <table>$RowData</table><br>Thank You,<br><br>Messaging</body></html>"

#Send Email with No Exploits found
if($i -eq 0)
{
    #Send Message Setup Section
    $message = new-object System.Net.Mail.MailMessage
    $message.From=$From
    $message.Sender=$From
    $message.ReplyTo=$From
    foreach($t in $To){$message.To.Add($t)}
    $message.IsBodyHtml = $True
    $Sub=$Sub.Replace("[SUBJECT]","REPORT: No Exploits found on")
    $message.Subject = $Sub
    $message.Body = $Bod1
    $smtp = new-object Net.Mail.SmtpClient($SmtpSrvr)
    $smtp.Send($message)
}
#At least 1 exploit found, send email with data table
else
{
    #Send Message Setup Section
    $message = new-object System.Net.Mail.MailMessage
    $message.From=$From
    $message.Sender=$From
    $message.ReplyTo=$From
    foreach($t in $To){$message.To.Add($t)}
    $message.IsBodyHtml = $True
    $Sub=$Sub.Replace("[SUBJECT]","ALERT: EXPLOITS found on")
    $Bod2=$Bod2
    $message.Subject = $Sub
    $message.Body = $Bod2
    $smtp = new-object Net.Mail.SmtpClient($SmtpSrvr)
    $smtp.Send($message)
}