https://pastein.ru/t/ivT
Загрузка данных
@echo off
chcp 1251 >nul
setlocal enabledelayedexpansion
:: ------------------------------------------------------------------
:: Конфигурация
:: ------------------------------------------------------------------
set "REPORT_ROOT=\\sns\Документация\Отчеты"
set "COMPUTER=%COMPUTERNAME%"
set "TIMESTAMP=%DATE:~6,4%%DATE:~3,2%%DATE:~0,2%_%TIME:~0,2%%TIME:~3,2%%TIME:~6,2%"
set "TIMESTAMP=%TIMESTAMP: =0%"
set "REPORT_FILE=%COMPUTER%-audit-%TIMESTAMP%.csv"
set "TEMP_DIR=%TEMP%\audit_temp"
if not exist "%TEMP_DIR%" mkdir "%TEMP_DIR%" 2>nul
set "ALL_FILES_LIST=%TEMP_DIR%\all_files.txt"
set "FILTERED_FILES=%TEMP_DIR%\filtered.txt"
set "FOUND_FLAG=0"
set "DEBUG_LOG=%TEMP%\audit_debug.log"
echo ===== АУДИТ ViPNet (с хэшами) ===== > "%DEBUG_LOG%"
echo Запуск: %DATE% %TIME% >> "%DEBUG_LOG%"
echo Компьютер: %COMPUTER% >> "%DEBUG_LOG%"
:: Списки хэшей
set "BAD_SHA256_LIST=8b089163edb36e7a65baccb8ab317895162057a1acb2a5dc59dffd3d03c7cdb5;7d0e3efe656a28251e6460af1baa489ea6a07053a4bc6578edba659ab28afd5d;68b4c76a2280e3c31130d4de12b12dfd479a476f347f5b4a58cb2483d74aba7e;841aea34ca81577468c3a5ab3039370a83cd9dca7ad95af092a9a22b661ec3f1;b8192bb83d5d33bf6e32879d2bfb783cbbd3df6ded23206867161f091897d4c4;ffdc194775b2904564bbbd1cf0eb01d1a01f83ef5197d1612b6e2d69de7a4732;5e462c89def65cbdddbd3ae78a1e281400199143af330e976384416cf466b9d8;e19adeaaa9f19f2cf0460d9f61ff54e90b5de30c2cd8d1db04fdf8afaa243295;bc34b8d8bc320c5fa1d280e6a7ca876950047d2ee0520b0f5e49bb49481e987d;4921e2f1fb2ef81862e6727bbac653c8e66fd2132529205798788981905151fc;13d8d4f4fa483111e4372a6925d24e28f3be082a2ea8f44304384982bd692ec9;c2f2a6a28d41ac243455a30c4ab39af13ed647e43d00eb69c14482e9314e9140"
set "BAD_MD5_LIST=82dd0af848118009709639d75ca43bd9;5384157b66e9976c9a1c8429d236b512"
:: Имена файлов с хэшами
set "HASH_SHA256_NAMES=SetupCheck.dll SetupChk.exe Rngsdkcfg.exe wtsapi32.dll m02smnrf.ctl mocdng.dll update.bat info.bat mustd.exe Diagnosis.exe"
set "HASH_MD5_NAMES=odcitvmd.dll msvdplib.dll"
set "LEGACY_NAMES=Rngpkcsmgr.exe server_updown.exe server_updown.pdb"
echo ============================================================
echo АУДИТ ПО ИНДИКАТОРАМ КОМПРОМЕТАЦИИ ViPNet
echo Компьютер: %COMPUTER%
echo Время: %DATE% %TIME%
echo ============================================================
:: Проверка сетевой папки
if not exist "%REPORT_ROOT%" (
echo [WARN] Сетевая папка %REPORT_ROOT% не найдена.
set "REPORT_ROOT=C:\Temp"
if not exist "!REPORT_ROOT!" mkdir "!REPORT_ROOT!" 2>nul
)
echo Computer;Scope;Type;Path;Found;Details > "%REPORT_ROOT%\%REPORT_FILE%" 2>nul
if errorlevel 1 (
set "REPORT_ROOT=C:\Temp"
if not exist "!REPORT_ROOT!" mkdir "!REPORT_ROOT!" 2>nul
echo Computer;Scope;Type;Path;Found;Details > "!REPORT_ROOT!\%REPORT_FILE%"
)
echo [INFO] Отчёт: %REPORT_ROOT%\%REPORT_FILE% >> "%DEBUG_LOG%"
:: ------------------------------------------------------------------
:: Шаг 1: Проверка ViPNet
:: ------------------------------------------------------------------
echo [STEP 1] Проверка ViPNet... >> "%DEBUG_LOG%"
echo [STEP 1] Проверка установленного ПО ViPNet ...
set "VIPNET_INSTALLED=0"
for %%p in (
"HKLM\SOFTWARE\WOW6432Node\InfoTeCS\ViPNet Client"
"HKLM\SOFTWARE\InfoTeCS\ViPNet Client"
"HKLM\SOFTWARE\WOW6432Node\InfoTeCS\ViPNet"
"HKLM\SOFTWARE\InfoTeCS\ViPNet"
"HKCU\Software\InfoTeCS\ViPNet Client"
) do (
reg query "%%~p" 2>nul >nul
if not errorlevel 1 (
set "VIPNET_INSTALLED=1"
echo Найдена запись: %%~p
echo %COMPUTER%;ViPNet;Registry;%%~p;YES;Found >> "%REPORT_ROOT%\%REPORT_FILE%"
for /f "tokens=2 delims= " %%v in ('reg query "%%~p" /v Version 2^>nul') do (
if not "%%v"=="" echo %COMPUTER%;ViPNet;Info;Version;YES;%%v >> "%REPORT_ROOT%\%REPORT_FILE%"
)
for /f "tokens=2 delims= " %%b in ('reg query "%%~p" /v Build 2^>nul') do (
if not "%%b"=="" echo %COMPUTER%;ViPNet;Info;Build;YES;%%b >> "%REPORT_ROOT%\%REPORT_FILE%"
)
goto :vipnet_found
)
)
for %%e in (
"C:\Program Files\InfoTeCS\ViPNet\ViPNet.exe"
"C:\Program Files (x86)\InfoTeCS\ViPNet\ViPNet.exe"
"C:\Program Files\InfoTeCS\ViPNet Client\ViPNet.exe"
"C:\Program Files (x86)\InfoTeCS\ViPNet Client\ViPNet.exe"
) do (
if exist "%%~e" (
set "VIPNET_INSTALLED=1"
echo %COMPUTER%;ViPNet;File;%%~e;YES;Found executable >> "%REPORT_ROOT%\%REPORT_FILE%"
goto :vipnet_found
)
)
sc query "ViPNetClient" 2>nul | findstr /i "SERVICE_STATE" >nul
if not errorlevel 1 (
set "VIPNET_INSTALLED=1"
echo %COMPUTER%;ViPNet;Service;ViPNetClient;YES;Service exists >> "%REPORT_ROOT%\%REPORT_FILE%"
goto :vipnet_found
)
sc query "VipNet" 2>nul | findstr /i "SERVICE_STATE" >nul
if not errorlevel 1 (
set "VIPNET_INSTALLED=1"
echo %COMPUTER%;ViPNet;Service;VipNet;YES;Service exists >> "%REPORT_ROOT%\%REPORT_FILE%"
goto :vipnet_found
)
:vipnet_found
if "%VIPNET_INSTALLED%"=="0" (
echo %COMPUTER%;ViPNet;Info;ViPNet;NO;Not installed >> "%REPORT_ROOT%\%REPORT_FILE%"
)
echo [STEP 1] Завершён. >> "%DEBUG_LOG%"
:: ------------------------------------------------------------------
:: Шаг 2: wtsapi32.dll в каталоге обновлений ViPNet
:: ------------------------------------------------------------------
echo [STEP 2] Проверка wtsapi32.dll... >> "%DEBUG_LOG%"
echo [STEP 2] Проверка wtsapi32.dll в каталоге обновлений ViPNet ...
set "VIPNET_UPDATE_PATHS="
if exist "C:\Program Files (x86)\InfoTeCS\ViPNet\Update" set "VIPNET_UPDATE_PATHS=!VIPNET_UPDATE_PATHS! "C:\Program Files (x86)\InfoTeCS\ViPNet\Update""
if exist "C:\Program Files\InfoTeCS\ViPNet\Update" set "VIPNET_UPDATE_PATHS=!VIPNET_UPDATE_PATHS! "C:\Program Files\InfoTeCS\ViPNet\Update""
if exist "C:\ProgramData\InfoTeCS\ViPNet\Update" set "VIPNET_UPDATE_PATHS=!VIPNET_UPDATE_PATHS! "C:\ProgramData\InfoTeCS\ViPNet\Update""
if "!VIPNET_UPDATE_PATHS!"=="" (
echo %COMPUTER%;ViPNet;File;ViPNet Update directory;NO;Not found >> "%REPORT_ROOT%\%REPORT_FILE%"
) else (
for %%u in (!VIPNET_UPDATE_PATHS!) do (
set "update_dir=%%~u"
if exist "!update_dir!\wtsapi32.dll" (
set "FOUND_FLAG=1"
for %%a in ("!update_dir!\wtsapi32.dll") do (
set "fsize=%%~za"
set "fdate=%%~ta"
echo %COMPUTER%;ViPNet;File;!update_dir!\wtsapi32.dll;CRITICAL;Size: !fsize!, Modified: !fdate! - DLL Sideloading IoC >> "%REPORT_ROOT%\%REPORT_FILE%"
)
) else (
echo %COMPUTER%;ViPNet;File;!update_dir!\wtsapi32.dll;NO;Not found >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
)
echo [STEP 2] Завершён. >> "%DEBUG_LOG%"
:: ------------------------------------------------------------------
:: Шаг 3: Сбор списка всех файлов на C: и D:
:: ------------------------------------------------------------------
echo [STEP 3] Сканирование дисков... >> "%DEBUG_LOG%"
echo [STEP 3] Сканирование дисков C: и D: ...
(for %%d in (C: D:) do (
if exist "%%d\" (
echo Сканирую диск %%d ...
dir /s /b "%%d\" 2>nul
)
)) > "%ALL_FILES_LIST%"
echo [INFO] Сбор завершён. >> "%DEBUG_LOG%"
:: Фильтрация по именам
findstr /i "SetupCheck.dll SetupChk.exe Rngsdkcfg.exe wtsapi32.dll m02smnrf.ctl mocdng.dll update.bat info.bat odcitvmd.dll msvdplib.dll mustd.exe Diagnosis.exe Rngpkcsmgr.exe server_updown.exe server_updown.pdb .batcmd.exe" "%ALL_FILES_LIST%" > "%FILTERED_FILES%" 2>nul
echo [STEP 3] Завершён. >> "%DEBUG_LOG%"
:: ------------------------------------------------------------------
:: Шаг 4: Обработка найденных файлов (хэши)
:: ------------------------------------------------------------------
echo [STEP 4] Обработка файлов... >> "%DEBUG_LOG%"
echo [STEP 4] Проверка найденных файлов ...
if not exist "%FILTERED_FILES%" (
echo %COMPUTER%;Global;File;All drives;NO;No suspicious files found >> "%REPORT_ROOT%\%REPORT_FILE%"
) else (
for /f "delims=" %%p in ('type "%FILTERED_FILES%"') do (
set "filepath=%%p"
set "fname=%%~nxp"
:: Проверка SHA256
echo !fname! | findstr /i "\<SetupCheck.dll\> \<SetupChk.exe\> \<Rngsdkcfg.exe\> \<wtsapi32.dll\> \<m02smnrf.ctl\> \<mocdng.dll\> \<update.bat\> \<info.bat\> \<mustd.exe\> \<Diagnosis.exe\>" >nul
if not errorlevel 1 (
set "hash="
for /f "delims=" %%h in ('certutil -hashfile "!filepath!" SHA256 2^>nul ^| findstr /v "certutil" ^| findstr /v "hash"') do (
set "hash=%%h"
set "hash=!hash: =!"
)
if "!hash!"=="" (
echo %COMPUTER%;Global;File;!filepath!;ERROR;Unable to compute SHA256 >> "%REPORT_ROOT%\%REPORT_FILE%"
) else (
echo !BAD_SHA256_LIST! | findstr /i "!hash!" >nul
if not errorlevel 1 (
set "FOUND_FLAG=1"
echo %COMPUTER%;Global;File;!filepath!;CRITICAL;Hash matches known bad (SHA256: !hash!) >> "%REPORT_ROOT%\%REPORT_FILE%"
) else (
echo %COMPUTER%;Global;File;!filepath!;YES;Hash does not match any known bad (SHA256: !hash!) >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
)
:: Проверка MD5
echo !fname! | findstr /i "\<odcitvmd.dll\> \<msvdplib.dll\>" >nul
if not errorlevel 1 (
set "hash="
for /f "delims=" %%h in ('certutil -hashfile "!filepath!" MD5 2^>nul ^| findstr /v "certutil" ^| findstr /v "hash"') do (
set "hash=%%h"
set "hash=!hash: =!"
)
if "!hash!"=="" (
echo %COMPUTER%;Global;File;!filepath!;ERROR;Unable to compute MD5 >> "%REPORT_ROOT%\%REPORT_FILE%"
) else (
echo !BAD_MD5_LIST! | findstr /i "!hash!" >nul
if not errorlevel 1 (
set "FOUND_FLAG=1"
echo %COMPUTER%;Global;File;!filepath!;CRITICAL;Hash matches known bad (MD5: !hash!) >> "%REPORT_ROOT%\%REPORT_FILE%"
) else (
echo %COMPUTER%;Global;File;!filepath!;YES;Hash does not match any known bad (MD5: !hash!) >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
)
:: Legacy-имена
echo !fname! | findstr /i "\<Rngpkcsmgr.exe\> \<server_updown.exe\> \<server_updown.pdb\>" >nul
if not errorlevel 1 (
set "FOUND_FLAG=1"
echo %COMPUTER%;Global;File;!filepath!;YES;Legacy IoC (no hash) >> "%REPORT_ROOT%\%REPORT_FILE%"
)
:: Маска *.batcmd.exe
echo !fname! | findstr /i ".batcmd.exe" >nul
if not errorlevel 1 (
set "FOUND_FLAG=1"
echo %COMPUTER%;Global;File;!filepath!;YES;Matched mask *.batcmd.exe >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
)
echo [STEP 4] Завершён. >> "%DEBUG_LOG%"
:: ------------------------------------------------------------------
:: Шаг 5: Аудит каталогов (только подозрительные имена и маска)
:: ------------------------------------------------------------------
echo [STEP 5] Аудит каталогов... >> "%DEBUG_LOG%"
echo [STEP 5] Проверка каталогов на наличие подозрительных файлов ...
set "SUSPICIOUS_NAMES=SetupCheck.dll SetupChk.exe Rngsdkcfg.exe wtsapi32.dll m02smnrf.ctl mocdng.dll update.bat info.bat odcitvmd.dll msvdplib.dll mustd.exe Diagnosis.exe Rngpkcsmgr.exe server_updown.exe server_updown.pdb"
set "SUSPICIOUS_MASK=*.batcmd.exe"
set "FOLDER_LIST="C:\Windows\Temp" "C:\ProgramData" "C:\Program Files" "C:\Program Files (x86)" "C:\Program Files\Common Files\InfoTeCS" "C:\ProgramData\InfoTeCS""
for /d %%u in (C:\Users\*) do (
if exist "%%u\AppData\Local\Temp" set "FOLDER_LIST=!FOLDER_LIST! "%%u\AppData\Local\Temp""
)
for %%f in (%FOLDER_LIST%) do (
set "folder=%%~f"
if exist "!folder!" (
:: Проверка точных имён
for %%n in (%SUSPICIOUS_NAMES%) do (
if exist "!folder!\%%n" (
set "FOUND_FLAG=1"
for %%a in ("!folder!\%%n") do (
set "fsize=%%~za"
set "fdate=%%~ta"
echo %COMPUTER%;FolderAudit;File;!folder!\%%n;YES;Size: !fsize!, Modified: !fdate! >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
)
:: Поиск по маске
for /f "delims=" %%p in ('dir /s /b "!folder!\%SUSPICIOUS_MASK%" 2^>nul') do (
set "FOUND_FLAG=1"
for %%a in ("%%p") do (
set "fsize=%%~za"
set "fdate=%%~ta"
echo %COMPUTER%;FolderAudit;File;%%p;YES;Size: !fsize!, Modified: !fdate! >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
) else (
echo %COMPUTER%;FolderAudit;Folder;!folder!;NO;Folder does not exist >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
echo [STEP 5] Завершён. >> "%DEBUG_LOG%"
:: ------------------------------------------------------------------
:: Шаг 6: Проверка реестра
:: ------------------------------------------------------------------
echo [STEP 6] Проверка реестра... >> "%DEBUG_LOG%"
echo [STEP 6] Проверка веток реестра ...
set "REG_PATHS=HKLM\SYSTEM\CurrentControlSet\Services\ScNetSvc HKLM\SYSTEM\CurrentControlSet\Services\ScNetSvc\Parameters HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost\netsvcs HKLM\Software\Microsoft\Windows\CurrentVersion\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce HKCU\Software\Classes\CLSID\{d9144dcd-e998-4eca-ab6a-dcd83ccba16d}\InprocServer32"
for %%r in (%REG_PATHS%) do (
set "regpath=%%r"
reg query "!regpath!" 2>nul >nul
if errorlevel 1 (
echo %COMPUTER%;Registry;Registry;!regpath!;NO;Branch does not exist >> "%REPORT_ROOT%\%REPORT_FILE%"
) else (
set "hasValues=0"
for /f "delims=" %%v in ('reg query "!regpath!" 2^>nul ^| findstr /v /i "HKEY" ^| findstr /v "^$"') do (
set "hasValues=1"
set "FOUND_FLAG=1"
echo %COMPUTER%;Registry;Registry;!regpath!;YES;%%v >> "%REPORT_ROOT%\%REPORT_FILE%"
)
if "!hasValues!"=="0" (
echo %COMPUTER%;Registry;Registry;!regpath!;YES;Branch exists but no values >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
)
echo [STEP 6] Завершён. >> "%DEBUG_LOG%"
:: ------------------------------------------------------------------
:: Шаг 7: Поиск переименованных PuTTY/Plink (только .exe, исключая стандартные)
:: ------------------------------------------------------------------
echo [STEP 7] Поиск PuTTY... >> "%DEBUG_LOG%"
echo [STEP 7] Поиск переименованных PuTTY и Plink ...
:: Ищем .exe, содержащие putty или plink как целое слово, но не стандартные имена
findstr /i /r "\<putty\> \<plink\>" "%ALL_FILES_LIST%" | findstr /i ".exe" | findstr /v /i "\<putty.exe\> \<plink.exe\>" > "%TEMP_DIR%\putty_found.txt" 2>nul
if exist "%TEMP_DIR%\putty_found.txt" (
for /f "delims=" %%p in ('type "%TEMP_DIR%\putty_found.txt"') do (
set "FOUND_FLAG=1"
for %%a in ("%%p") do (
set "fsize=%%~za"
set "fdate=%%~ta"
echo %COMPUTER%;Putty;File;%%p;SUSPICIOUS;Size: !fsize!, Modified: !fdate! - Possible renamed PuTTY/Plink >> "%REPORT_ROOT%\%REPORT_FILE%"
)
)
) else (
echo %COMPUTER%;Putty;File;All drives;NO;No renamed PuTTY/Plink found >> "%REPORT_ROOT%\%REPORT_FILE%"
)
echo [STEP 7] Завершён. >> "%DEBUG_LOG%"
:: ------------------------------------------------------------------
:: Шаг 8: Реагирование
:: ------------------------------------------------------------------
echo [STEP 8] Реагирование... >> "%DEBUG_LOG%"
if "%FOUND_FLAG%"=="1" (
echo [!!!!!!] ВНИМАНИЕ! Обнаружены индикаторы компрометации!
eventcreate /ID 1001 /L APPLICATION /T ERROR /SO "KSC-Audit" /D "ViPNet IoC detected on %COMPUTER%! Report: %REPORT_ROOT%\%REPORT_FILE%" 2>nul
set "EICAR_PART1=X5O!P%%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-"
set "EICAR_PART2=ANTIVIRUS-TEST-FILE!$H+H*"
set "EICAR_FILE=%TEMP%\eicar_%RANDOM%.com"
echo %EICAR_PART1%%EICAR_PART2% > "%EICAR_FILE%"
if exist "%EICAR_FILE%" echo [INFO] Создан EICAR-файл: %EICAR_FILE%
) else (
echo [OK] Индикаторы компрометации НЕ обнаружены.
eventcreate /ID 1000 /L APPLICATION /T INFORMATION /SO "KSC-Audit" /D "ViPNet audit completed on %COMPUTER%, no IoC detected." 2>nul
)
:: ------------------------------------------------------------------
:: Завершение
:: ------------------------------------------------------------------
echo.
echo ============================================================
echo Аудит завершён.
echo Отчёт: %REPORT_ROOT%\%REPORT_FILE%
echo Лог: %DEBUG_LOG%
echo ============================================================
del "%ALL_FILES_LIST%" 2>nul
del "%FILTERED_FILES%" 2>nul
del "%TEMP_DIR%\putty_found.txt" 2>nul
rd "%TEMP_DIR%" 2>nul
pause