---

notepad "C:\Users\Nikis\Documents\soc-lab\security_audit.ps1"


Get-Date > "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"
hostname >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"
whoami >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"

Get-NetIPAddress -AddressFamily IPv4 | Where-Object {$_.IPAddress -notlike "127.*"} | Select-Object InterfaceAlias, IPAddress >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"

Get-Process | Sort-Object WS -Descending | Select-Object -First 5 -Property Name, ID, WS >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"

Get-Service | Where-Object {$_.Status -eq "Running" -and $_.StartType -eq "Automatic"} | Select-Object -First 10 Name, DisplayName >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"

Get-NetTCPConnection -State Listen | Select-Object LocalPort, OwningProcess >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"

Get-NetFirewallProfile | Select-Object Name, Enabled >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"

Get-EventLog -LogName System -Newest 5 | Select-Object TimeGenerated, EntryType, Source, Message >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"

Get-ChildItem -Path "C:\Users\Nikis\Documents\soc-lab\*" -Include "*.txt" -Exclude "*audit*" | Get-FileHash -Algorithm SHA256 >> "C:\Users\Nikis\Documents\soc-lab\windows_security_audit.txt"


& "C:\Users\Nikis\Documents\soc-lab\security_audit.ps1"