мини ав на batch

@echo off
setlocal enabledelayedexpansion

:: Administrator privileges check
net session >nul 2>&1
if %errorLevel% neq 0 (
    echo ERROR: Please run this script AS ADMINISTRATOR!
    pause
    exit
)

set "p1=https"
set "p2=://urlhaus"
set "p3=.abuse.ch"
set "p4=/downloads"
set "p5=/text/"
set "TARGET=%p1%%p2%%p3%%p4%%p5%"

set "RULE_PREFIX=NetBlock_"
set "TMP_F=%temp%\inf.tmp"

:update
echo [%time%] Downloading Threat Intelligence Database...
powershell -Command "$u='%TARGET%'; try { $c=(Invoke-WebRequest -Uri $u -UseBasicParsing -TimeoutSec 10).Content; [regex]::Matches($c, '\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b').Value | Select-Object -Unique | Out-File -FilePath '%TMP_F%' -Encoding ascii } catch { echo 'Connection error with URLhaus' }"

if not exist "%TMP_F%" (
    echo ERROR: IP database file not found. Check your connection.
    timeout /t 5
    goto l
)

echo [%time%] Updating Firewall Rules...
for /f "tokens=1,* delims=: " %%a in ('netsh advfirewall firewall show rule name^=all ^| findstr /C:"%RULE_PREFIX%"') do (
    netsh advfirewall firewall delete rule name="%%b" >nul 2>&1
)

set "bl=" & set "bc=0" & set "idx=1"
for /f "usebackq tokens=*" %%a in ("%TMP_F%") do (
    set "bl=!bl!,%%a"
    set /a bc+=1
    if !bc! geq 20 (
        netsh advfirewall firewall add rule name="%RULE_PREFIX%!idx!" dir=out action=block remoteip=!bl:~1! >nul 2>&1
        set "bl=" & set "bc=0" & set /a idx+=1
    )
)
if defined bl netsh advfirewall firewall add rule name="%RULE_PREFIX%!idx!" dir=out action=block remoteip=!bl:~1! >nul 2>&1
del /f /q "%TMP_F%" >nul 2>&1

:l
set "found="
:: Direct process monitoring
for %%p in (wscript.exe cscript.exe certutil.exe mshta.exe vssadmin.exe bitsadmin.exe) do (
    taskkill /f /im %%p >nul 2>&1 && (
        echo [%time%] !!! THREAT DETECTED: %%p KILLED !!!
        set "found=1"
    )
)

if defined found (
    echo [%time%] ATTACK DETECTED! Isolating network...
    ipconfig /flushdns >nul 2>&1
    ipconfig /release >nul 2>&1
    ipconfig /renew >nul 2>&1
)

timeout /t 1 /nobreak >nul
goto update