├── .gitignore
├── powershell
    ├── Shutdown.ps1
    ├── Restart.ps1
    ├── DeleteScheduleTask.ps1
    ├── GetDrivesInfo.ps1
    ├── Collect-AutorunList.ps1
    ├── RunCommands.ps1
    ├── DeleteFileFolder.ps1
    ├── KillProcessByNameOrPid.ps1
    ├── Collect-SYSTEMv1.1.ps1
    ├── LocalAccountDisableRemove.ps1
    ├── GetPrefetch.ps1
    ├── Collect-WMIRepo.ps1
    ├── Collect-FWRules.ps1
    └── Collect-EVTX.ps1
├── bash
    ├── killByName.sh
    └── killByPid.sh
├── .github
    └── workflows
    │   └── codeql.yml
├── README.md
├── SECURITY.md
├── python
    └── sysinfo.py
└── LICENSE


/.gitignore:
--------------------------------------------------------------------------------
1 | .DS_Store
2 | 


--------------------------------------------------------------------------------
/powershell/Shutdown.ps1:
--------------------------------------------------------------------------------
 1 | <#
 2 | 
 3 | .SYNOPSIS
 4 | 
 5 | Powershell script to shutdown an EndPoint
 6 | 
 7 | .DESCRIPTION
 8 | While preserving evidence is key in DFIR, after you carefully capture evidence you may need to shutdown a computer.
 9 | 
10 | .EXAMPLE
11 | 
12 | Shutdown.ps1
13 | 
14 | .NOTES
15 | Demo Custom Script for Trend Micro Vision One, Provided as is by the product team.
16 | 
17 | #>
18 | 
19 | Write-host "Script: Shutdown.ps1"
20 | Stop-Computer -ComputerName localhost


--------------------------------------------------------------------------------
/powershell/Restart.ps1:
--------------------------------------------------------------------------------
 1 | <#
 2 | 
 3 | .SYNOPSIS
 4 | 
 5 | Powershell script to restart an EndPoint
 6 | 
 7 | .DESCRIPTION
 8 | While preserving evidence is key in DFIR, after you carefully capture evidence you may need remediate and apply a patch and you need to reboot the computer.
 9 | 
10 | .EXAMPLE
11 | 
12 | Restart.ps1
13 | 
14 | .NOTES
15 | Demo Custom Script for Trend Micro Vision One, Provided as is by the product team.
16 | 
17 | #>
18 | 
19 | Write-host "Script: Restart.ps1"
20 | Restart-Computer


--------------------------------------------------------------------------------
/bash/killByName.sh:
--------------------------------------------------------------------------------
 1 | #/bin/bash
 2 | 
 3 | #Killing a process by name, you need to pass the process name like:
 4 | #KillByName ping
 5 | 
 6 | # Check if the argument is provided
 7 | if [ "$#" -ne 1 ]; then
 8 |     echo "Usage: $0 <process-name>"
 9 |     exit 1
10 | fi
11 | 
12 | # Get the process name from the argument
13 | PROCESS_NAME="$1"
14 | 
15 | # Use pkill to kill the process by name
16 | pkill "$PROCESS_NAME"
17 | 
18 | # Check the success status of pkill
19 | if [ $? -eq 0 ]; then
20 |     echo "Successfully killed process(es) with name: $PROCESS_NAME"
21 | else
22 |     echo "Failed to kill process(es) with name: $PROCESS_NAME"
23 | fi
24 | 
25 | 


--------------------------------------------------------------------------------
/bash/killByPid.sh:
--------------------------------------------------------------------------------
 1 | #/bin/bash
 2 | 
 3 | #Killing a process per process Id"
 4 | #KillByPid 100
 5 | echo "Killing a process per process Id: $(kill $1)"
 6 | 
 7 | # Check if the argument is provided
 8 | if [ "$#" -ne 1 ]; then
 9 |     echo "Usage: $0 <process-id>"
10 |     exit 1
11 | fi
12 | 
13 | # Get the process ID from the argument
14 | PROCESS_ID="$1"
15 | 
16 | # Use kill command to kill the process by its PID
17 | kill "$PROCESS_ID"
18 | 
19 | # Check the success status of kill
20 | if [ $? -eq 0 ]; then
21 |     echo "Successfully killed process with PID: $PROCESS_ID"
22 | else
23 |     echo "Failed to kill process with PID: $PROCESS_ID"
24 | fi
25 | 


--------------------------------------------------------------------------------
/powershell/DeleteScheduleTask.ps1:
--------------------------------------------------------------------------------
 1 | # Delete a schedule task for use in response  
 2 | # Trend Micro Vision One Custom Script Example with parameters
 3 | # D. Girard Vision One PM Team
 4 | # To delete a windows Scheduled task that you identified, just pass the task name
 5 | # -taskName "VisionOneDemo"
 6 | param(
 7 | [Parameter (Mandatory = $true)] [String]$taskName
 8 | )
 9 | Write-host "Schedule Task Name to delete:" $taskName
10 | $taskExists = Get-ScheduledTask | Where-Object {$_.TaskName -like $taskName }
11 | if ($taskExists) {
12 |     Unregister-ScheduledTask -TaskPath "\*" -TaskName $taskName -Confirm:$false
13 |     Write-host "Scheduled task deleted" $taskName
14 | }
15 | else {Write-host "Scheduled task" $taskName "does not exist" }   
16 | 
17 | 


--------------------------------------------------------------------------------
/powershell/GetDrivesInfo.ps1:
--------------------------------------------------------------------------------
 1 | <#
 2 | 
 3 | .SYNOPSIS
 4 | 
 5 | Powershell script listing of drives connected to the EndPoint
 6 | 
 7 | .DESCRIPTION
 8 | Enumerating the list of connected drives to a computer is a basic incident response task
 9 | 
10 | .EXAMPLE
11 | 
12 | GetDrivesInfo.ps1
13 | 
14 | .NOTES
15 | Demo Custom Script for Trend Micro Vision One, Provided as is by the product team.
16 | 
17 | #>
18 | 
19 | Write-host "Script: GetDrivesInfo.ps1"
20 | # Get-PSDrive
21 | Get-PSDrive | where{$_.DisplayRoot -match "\\"}
22 | Get-CimInstance -ClassName Win32_MappedLogicalDisk | Select SystemName, DeviceID, ProviderName, FileSystem, FreeSpace, Size, StatusInfo, Name, InstallDate, VolumeName, VolumeSerialNumber, Description, Caption, Availability, BlockSize, Access, Status, Compressed
23 | [System.IO.DriveInfo]::getdrives()


--------------------------------------------------------------------------------
/powershell/Collect-AutorunList.ps1:
--------------------------------------------------------------------------------
 1 | $ErrorActionPreference = 'SilentlyContinue'
 2 | 
 3 | #List all startup
 4 | Write-Output "=====Listing Startup Programs====="
 5 | Get-CimInstance Win32_StartupCommand | Select-Object Name, command, Location, User | Format-List
 6 | 
 7 | #List all services
 8 | Write-Output "=====Listing Services====="
 9 | Get-WmiObject win32_service | Select-Object Name, DisplayName, State, PathName | Format-List
10 | 
11 | #List all Scheduled tasks
12 | Write-Output "=====Listing Scheduled tasks====="
13 | Get-ScheduledTask | Select-Object TaskName, TaskPath, State, @{Name="Command"; Expression={ $_.Actions.execute}}, @{Name="Arguments"; Expression={ $_.Actions.Arguments}}  | Format-List
14 | 
15 | #Get WMI persistence
16 | Write-Output "=====Listing WMI Subscriptions====="
17 | Get-WmiObject -Class __FilterToConsumerBinding -Namespace root\subscription
18 | Get-WmiObject -Class __EventFilter -Namespace root\subscription
19 | Get-WmiObject -Class __EventConsumer -Namespace root\subscription
20 | 


--------------------------------------------------------------------------------
/powershell/RunCommands.ps1:
--------------------------------------------------------------------------------
 1 | # Run any Powershell Expression
 2 | # Trend Micro Vision One Custom Script Example with parameters
 3 | # D. Girard Vision One PM Team
 4 | # To run any commands from Vision One Custom Script Parameter use this
 5 | # it could be Windows commands or pure powershell. results will be wrote to V1 results 
 6 | # https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/invoke-command?view=powershell-7.2
 7 | # -expression "ping 192.168.1.1"
 8 | # -expression "Get-Service"
 9 | # -expression "Get-ChildItem c:\ir, *.*"
10 | # -expression "Invoke-WMIMethod -Class Win32_Process -Name Create -ArgumentList Notepad.exe"
11 | param(
12 | [Parameter (Mandatory = $true)] [String]$expression
13 | ) 
14 | # need to convert string to script and add | Out-String to nicely format /n
15 | $scriptBlock = [Scriptblock]::Create($expression+"| Out-String")
16 | Write-host "RunCommands.ps1 -expression "$expression
17 | $results= Invoke-Command -ScriptBlock $scriptBlock
18 | Write-host $results


--------------------------------------------------------------------------------
/.github/workflows/codeql.yml:
--------------------------------------------------------------------------------
 1 | name: "Code Scanning"
 2 | 
 3 | # It trigger when any push or PR is made in the the code under the branch configured and every 09:00AM on Monday, Wednesday, and Friday
 4 | on:
 5 |   push:
 6 |     branches:
 7 |     - main
 8 |   pull_request:
 9 |     branches:
10 |     - main
11 |   schedule:
12 |     - cron: '0 9 * * 1,3,5'
13 | 
14 |   # Allows to run this workflow manually from the Actions tab
15 |   workflow_dispatch:
16 | 
17 | jobs:
18 |   analyze:
19 |     name: Analyze
20 |     runs-on: ubuntu-latest
21 |     permissions:
22 |       actions: read
23 |       contents: read
24 |       security-events: write
25 |     strategy:
26 |       fail-fast: false
27 |       matrix:
28 |         language: [ 'python' ]
29 |     steps:
30 |     - name: Checkout repository
31 |       uses: actions/checkout@v3
32 | 
33 |     # Initializes the CodeQL tools for scanning.
34 |     - name: Initialize CodeQL
35 |       uses: github/codeql-action/init@v2
36 |       with:
37 |         languages: ${{ matrix.language }}
38 |     - name: Perform CodeQL Analysis
39 |       uses: github/codeql-action/analyze@v2
40 | 


--------------------------------------------------------------------------------
/powershell/DeleteFileFolder.ps1:
--------------------------------------------------------------------------------
 1 | # Deletes files or folder example for use in response 
 2 | # Trend Micro Vision One Custom Script Example with parameters
 3 | # D. Girard Vision One PM Team
 4 | # To delete a file pass the folder name and the file name
 5 | # -folder "c:\testvisionOne" -fileName "testfile.txt"
 6 | # To delete a folder supply folder and deleteFolder $true 
 7 | # -folder "c:\testvisionOne" -deleteFolder $true
 8 | param(
 9 | [Parameter (Mandatory = $true)] [String]$folder, 
10 | [Parameter (Mandatory = $false)] [String]$fileName,
11 | [Parameter (Mandatory = $false)] [bool]$deleteFolder = $false
12 | )
13 | Write-host "DeleteFileFolder.ps1  parameters"
14 | Write-host "Folder:" $folder
15 | Write-host "File to delete:" $fileName
16 | Write-host "Force deleteFolder:" $deleteFolder
17 | $targetFullPath = Join-Path $folder $fileName
18 | if (Test-Path $targetFullPath) {
19 |     Remove-Item $targetFullPath -Force
20 |     Write-Host 'File deleted' $targetFullPath
21 | }
22 | else {Write-host "File does not exist" $targetFullPath}
23 | 
24 | if ($deleteFolder -And (Test-Path $targetFolder)) {
25 |     Remove-Item $targetFolder -Force
26 |     Write-Host 'Folder deleted' $targetFolder 
27 | }
28 | else {Write-host "Folder does not exist" $targetFolder}


--------------------------------------------------------------------------------
/powershell/KillProcessByNameOrPid.ps1:
--------------------------------------------------------------------------------
 1 | # Kill Process by process name or process id
 2 | # Trend Micro Vision One Custom Script Example with parameters
 3 | # Note: Kill process in Vision One use the SHA1 of the EXE responsible for the process. this script use 2 different methods
 4 | # D. Girard Vision One PM Team
 5 | # To kill a process by process name or process Id, use one of these 2 parameters:
 6 | # -pName "Notepad"
 7 | # -processId 3897 
 8 | param(
 9 | [Parameter (Mandatory = $false)] [String]$pName,
10 | [Parameter (Mandatory = $false)] [int]$processId
11 | )
12 | if ($pName) {
13 |     Write-host "KillProcessByNameOrPid.ps1" $pName
14 |     try{
15 |         Stop-Process -Name $pName -Force
16 |     }
17 |     catch{
18 |         Write-Host "Error killing process:" $pName
19 |         Write-Host "`nError Message: " $_.Exception.Message
20 |     }
21 |     Write-Host 'Process killed:' $pName
22 | }
23 | elseif ($processId) {
24 |     Write-host "KillProcessByNameOrPid.ps1" $processId.ToString()
25 |     try{
26 |         Stop-Process -Id $processId -Force
27 |         Write-Host 'Process killed:' $processId.ToString()
28 |     }
29 |     catch{
30 |         Write-Host "Error killing process:" $processId.ToString()
31 |         Write-Host "`nError Message: " $_.Exception.Message
32 |     }
33 | }


--------------------------------------------------------------------------------
/powershell/Collect-SYSTEMv1.1.ps1:
--------------------------------------------------------------------------------
 1 | $OutputEncoding = [console]::InputEncoding = [console]::OutputEncoding = [Text.UTF8Encoding]::UTF8;
 2 | $temp = $env:temp
 3 | $destinationDirectory = $temp+"\VisionOne-RegHive-backup\"
 4 |     
 5 |     #Check for admin rights
 6 |     if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
 7 |     {
 8 |         Write-Error "Not running as admin. Run the script with elevated credentials"
 9 |         Return
10 |     }
11 | 
12 | #Delete Temporary Directory, ensure there's no initial entry for it
13 | Remove-Item -LiteralPath $destinationDirectory -Force -Recurse
14 |  
15 | #Create V1 temp directory in temp folder
16 | New-Item -Path $temp -Name "VisionOne-RegHive-backup" -ItemType "directory"
17 |  
18 | #Change working directory
19 | cd $destinationDirectory
20 |  
21 | #Dump registries
22 | reg save HKLM\System System.reg
23 |  
24 | #Start the archive procedure and save the output to DestinationPath
25 | $compress = @{
26 |   Path = $destinationDirectory
27 |   CompressionLevel = "Fastest"
28 |   DestinationPath = "C:\VisionOne-RegDump-Logs.zip"
29 | }
30 | Compress-Archive -Force @compress
31 |  
32 | #Move out of working directory, to prepare for deletion
33 | cd ..
34 |  
35 | #Delete Temporary copies
36 | Remove-Item -LiteralPath $destinationDirectory -Force -Recurse
37 | 


--------------------------------------------------------------------------------
/powershell/LocalAccountDisableRemove.ps1:
--------------------------------------------------------------------------------
 1 | # Disable or Remove a compromised local account
 2 | # Trend Micro Vision One Custom Script Example with parameters
 3 | # D. Girard Vision One PM Team
 4 | # Be careful not to do more arms, validate the account is really compromised and you have other account to login to this endpoint
 5 | # To Disable or Remove a compromised Local Account
 6 | # -compromisedUser "user02" -action "Disable"
 7 | # -compromisedUser "user02" -action "Remove"
 8 | param(
 9 | [Parameter (Mandatory = $true)] [String]$compromisedUser, 
10 | [Parameter (Mandatory = $true)] [ValidateSet("Disable","Remove")][String]$action = "Disable"
11 | )
12 | Write-host "LocalAccountDisableRemove.ps1"
13 | if ($compromisedUser) {
14 |     $userExists = Get-LocalUser | Where-Object {$_.Name -like $compromisedUser}
15 |     if ($userExists) {
16 |         Write-Host "Local User exist : " $compromisedUser 
17 |         if ($action -eq "Disable") {
18 |             Disable-LocalUser -Name $compromisedUser
19 |             Write-Host "Local User disabled :" $compromisedUser 
20 |         }
21 |         elseif($action -eq "Remove") {
22 |             Remove-LocalUser -Name $compromisedUser
23 |             Write-Host "Local User removed : " $compromisedUser 
24 |         }
25 |         else {Write-host "action not recognized, please check misspelled action" $action}
26 |     }
27 |     else {Write-host "Local user does not exist" $compromisedUser}
28 | }


--------------------------------------------------------------------------------
/powershell/GetPrefetch.ps1:
--------------------------------------------------------------------------------
 1 | <#
 2 | 
 3 | .SYNOPSIS
 4 | 
 5 | Powershell listing of prefetch programs loaded in the past 24 hours
 6 | 
 7 | 
 8 | .DESCRIPTION
 9 | Windows caches programs for quick loading as part of the prefetch process.   This cmdlet is a 
10 | Powershell listing of prefetch programs loaded between a time range
11 | It is used in forensics to produce a timeline of loaded programs
12 | 
13 | .EXAMPLE
14 | 
15 | Getprefetch.ps1
16 | 
17 | .NOTES
18 | Demo Custom Script for Trend Micro Vision One, Provided as is by the product team.
19 | 
20 | #>
21 | $sdate = "yesterday"
22 | $stime = "00:00:00"
23 | $sdatetime = (get-date).adddays(-1)
24 | 
25 | # file time line
26 | $edate = "today"
27 | $etime = "23:59:59"
28 | $edatetime =get-date
29 | $etime = "23:59:59"
30 | 
31 | $xx = $env:SystemRoot
32 | $dir = $xx  + "\Prefetch"
33 | Write-host "Getprefetch - Windows prefetch file analyser (requires admin rights)"
34 | write-host "sdate:" $sdate  "stime:" $stime "edate:" $edate "etime:" $etime 
35 | Write-host "--------------------------------------------------------"
36 |  $timeline = Get-ChildItem   $dir   -filter "*.pf"  -force -erroraction silentlycontinue | Where-Object { $_.Lastwritetime -gt  $sdatetime  -and $_.Lastwritetime -lt $edatetime }  |Sort-Object -property lastwritetime
37 | foreach ( $aa in $timeline )
38 | {
39 |   $y = $aa.name  -replace "-.*\.pf", " "
40 | write-host ">" $aa.lastwritetime  " "  $aa.name  "                 " $y
41 | }
42 | 
43 | 
44 | #  | % {"us date: " +  $_.lastwritetime    +" "+    $_.fullname +" "+ $_.mode   }
45 | #-------------------
46 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | ## Introduction
 2 | 
 3 | Trend Vision One™ custom scripts for use through Vision One Remote Scripts or within your environment.
 4 | 
 5 | ## Documentation
 6 | 
 7 | Documentation will be updated upon release.
 8 | 
 9 | ## Contributing
10 | 
11 | ### Code of Conduct
12 | 
13 | Trend Micro has adopted a [Code of Conduct](CODE_OF_CONDUCT.md) that we expect project participants to adhere to. Please read the [full text](CODE_OF_CONDUCT.md) to understand what actions will and will not be tolerated.
14 | 
15 | ### Contributing Guide
16 | 
17 | Read our [contributing guide](CONTRIBUTING.md) to learn about our development process, how to propose bugfixes and improvements, and how to build and test your changes to Trend Vision One.
18 | 
19 | ## Community
20 | 
21 | ### Status & bugs
22 | 
23 | Currently Trend Vision One GitHub is under heavy development. If you wish to report bugs or request new features, you can use the [Github issues module](https://github.com/trendmicro/tm-v1-customscripts/issues).
24 | 
25 | ### Discussion
26 | 
27 | If you need support or you wish to engage a discussion about the Trend Vision One platform, feel free to join us on our [Forums](https://success.trendmicro.com/forum/s/topic/0TO4T000000LH90WAG/trend-micro-vision-one).
28 | 
29 | ### Support
30 | 
31 | Supports will be provided through the community. As this is an OSS project but not a formal Trend Micro product, formal product support is not applied.
32 | 
33 | ## About
34 | 
35 | ### Authors
36 | 
37 | Trend Vision One is a product designed and developed by the company [Trend Micro](https://www.trendmicro.com).
38 | 
39 | <a href="https://www.trendmicro.com" alt="Trend Micro"><img src="https://www.trendmicro.com/content/dam/trendmicro/global/en/core/images/logos/tm-logo-red-white-t.svg" width="230" /></a>
40 | 


--------------------------------------------------------------------------------
/SECURITY.md:
--------------------------------------------------------------------------------
 1 | # Security Policy
 2 | 
 3 | ## Supported Versions
 4 | 
 5 | There are no official “Long Term Support” versions; instead, fixes to vulnerabilities are made
 6 | for the latest feature release and merged up to the main branch.
 7 | 
 8 | The Trend Vision One Cloud Community makes no formal guarantee that any older maintenance tracks will receive updates.
 9 | In practice, though, critical vulnerability fixes are applied only to the most recent version.
10 | 
11 | ## Reporting a Vulnerability 
12 | 
13 | The Trend Vision One Cloud Community takes all security vulnerabilities seriously.
14 | Thank you for improving the security of our open-source software.
15 | We appreciate your efforts and responsible disclosure and will
16 | make every effort to acknowledge your contributions.
17 | 
18 | Report security vulnerabilities by creating a request to the Cloud One Community security team [here](https://github.com/trendmicro/tm-v1/security/advisories/new)
19 | 
20 | The lead maintainer will acknowledge your request and will
21 | send a more detailed response indicating the next steps in 
22 | handling your report. After the initial reply to your report, the security
23 | team will endeavor to keep you informed of the progress towards a fix and
24 | full announcement, and may ask for additional information or guidance.
25 | 
26 | Report security vulnerabilities in third-party modules to the person or 
27 | team maintaining the module.
28 | 
29 | ## Disclosure Policy
30 | 
31 | When the security team receives a security bug report, they assign it
32 | to a primary handler. This person will coordinate the fix and release
33 | process, involving the following steps:
34 | 
35 |   * Confirm the problem and determine the affected versions.
36 |   * Audit code to find any potential similar problems.
37 |   * Prepare fixes for all releases still under maintenance.
38 |   * These fixes will be released as fast as possible.
39 | 


--------------------------------------------------------------------------------
/powershell/Collect-WMIRepo.ps1:
--------------------------------------------------------------------------------
 1 | #Check for admin rights
 2 |     if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
 3 |     {
 4 |         Write-Error "Not running as admin. Run the script with elevated credentials"
 5 |         Return
 6 |     }
 7 | 
 8 | $sourceDirectory  = "C:\Windows\System32\wbem\Repository\*"
 9 | $destinationDirectory = "C:\Windows\Temp\VisionOne-WMIrepo-backup\"
10 | $zipfilename = "C:\VisionOne-WMIrepo-Logs.zip"
11 | 
12 | function Zip-Files(
13 |         [Parameter(Position=0, Mandatory=$true, ValueFromPipeline=$false)]
14 |         [string] $zipfilename,
15 |         [Parameter(Position=1, Mandatory=$true, ValueFromPipeline=$false)]
16 |         [string] $destinationDirectory,
17 |         [Parameter(Position=2, Mandatory=$false, ValueFromPipeline=$false)]
18 |         [bool] $overwrite)
19 | 
20 | {
21 |    Add-Type -Assembly System.IO.Compression.FileSystem
22 |    $compressionLevel = [System.IO.Compression.CompressionLevel]::Optimal
23 | 
24 |     if ($overwrite -eq $true )
25 |     {
26 |         if (Test-Path $zipfilename)
27 |         {
28 |             Remove-Item $zipfilename
29 |         }
30 |     }
31 | 
32 |     [System.IO.Compression.ZipFile]::CreateFromDirectory($destinationDirectory, $zipfilename, $compressionLevel, $false)
33 | }
34 | #Create V1 temp directory in C:\windows\temp
35 | New-Item -Path "C:\Windows\Temp" -Name "VisionOne-WMIrepo-backup" -ItemType "directory"
36 | #Copy contents from source to destination
37 | Copy-item -Force -Recurse -Verbose $sourceDirectory -Destination $destinationDirectory
38 | #Start the archive procedure and save the output to destination directory
39 | Zip-Files $zipfilename $destinationDirectory $true
40 | #delete copies of EVTX files in Temp folder 
41 | Remove-Item -LiteralPath $destinationDirectory -Force -Recurse


--------------------------------------------------------------------------------
/powershell/Collect-FWRules.ps1:
--------------------------------------------------------------------------------
 1 |  #Check for admin rights
 2 |     if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
 3 |     {
 4 |         Write-Error "Not running as admin. Run the script with elevated credentials"
 5 |         Return
 6 |     }
 7 | 
 8 | $destinationDirectory = "C:\Windows\Temp\VisionOne-WindowsFW-backup\"
 9 | $zipfilename = "C:\IR2\VisionOne-WindowsFWRules.zip"
10 | 
11 | function Zip-Files(
12 |         [Parameter(Position=0, Mandatory=$true, ValueFromPipeline=$false)]
13 |         [string] $zipfilename,
14 |         [Parameter(Position=1, Mandatory=$true, ValueFromPipeline=$false)]
15 |         [string] $destinationDirectory,
16 |         [Parameter(Position=2, Mandatory=$false, ValueFromPipeline=$false)]
17 |         [bool] $overwrite)
18 | 
19 | {
20 |    Add-Type -Assembly System.IO.Compression.FileSystem
21 |    $compressionLevel = [System.IO.Compression.CompressionLevel]::Optimal
22 | 
23 |     if ($overwrite -eq $true )
24 |     {
25 |         if (Test-Path $zipfilename)
26 |         {
27 |             Remove-Item $zipfilename
28 |         }
29 |     }
30 | 
31 |     [System.IO.Compression.ZipFile]::CreateFromDirectory($destinationDirectory, $zipfilename, $compressionLevel, $false)
32 | }
33 | #Create V1 temp directory in C:\windows\temp
34 | New-Item -Path "C:\Windows\Temp" -Name "VisionOne-WindowsFW-backup" -ItemType "directory"
35 | #Export Windows Defender Firewall rules
36 | netsh advfirewall export "$destinationDirectory\firewall-rules.wfw"
37 | # netsh advfirewall firewall show rule name = all | out-file .\rules.txt
38 | 
39 | #Start the archive procedure and save the output to destination directory
40 | #Zip-Files $zipfilename $destinationDirectory $true
41 | Compress-Archive -Path $destinationDirectory -DestinationPath $zipfilename
42 | #delete copies of EVTX files in Temp folder 
43 | #Remove-Item -LiteralPath $destinationDirectory -Force -Recurse 
44 | 


--------------------------------------------------------------------------------
/powershell/Collect-EVTX.ps1:
--------------------------------------------------------------------------------
 1 | # Check for admin rights
 2 | if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) {
 3 |     Write-Error "Not running as admin. Run the script with elevated credentials"
 4 |     exit
 5 | }
 6 | 
 7 | $EVTsourceDirectory   = "C:\windows\system32\config\*.evt"
 8 | $EVTXsourceDirectory  = "C:\windows\system32\winevt\Logs\*.evtx"
 9 | $destinationDirectory = "C:\Windows\Temp\VisionOne-EVTX-backup\"
10 | $zipfilename = "C:\data\VisionOne-EVTX-Logs.zip" #User configurable -- Change the directory to wherever you'd like to have the file placed on the local system
11 | 
12 | # Function to zip files
13 | function Zip-Files {
14 |     param (
15 |         [string] $zipfilename,
16 |         [string] $destinationDirectory,
17 |         [bool] $overwrite = $false
18 |     )
19 |     Add-Type -AssemblyName System.IO.Compression.FileSystem
20 |     $compressionLevel = [System.IO.Compression.CompressionLevel]::Optimal
21 | 
22 |     if ($overwrite -and (Test-Path $zipfilename)) {
23 |         Remove-Item $zipfilename -ErrorAction Stop
24 |     }
25 | 
26 |     try {
27 |         [System.IO.Compression.ZipFile]::CreateFromDirectory($destinationDirectory, $zipfilename, $compressionLevel, $false)
28 |         Write-Host "Files zipped successfully."
29 |     }
30 |     catch {
31 |         Write-Error "Error while zipping files: $_"
32 |     }
33 | }
34 | 
35 | # Create temp directory if it doesn't exist
36 | if (-Not (Test-Path $destinationDirectory)) {
37 |     New-Item -Path "C:\Windows\Temp" -Name "VisionOne-EVTX-backup" -ItemType "directory"
38 | }
39 | 
40 | # Get Windows version
41 | $version = (Get-CimInstance Win32_OperatingSystem).Version
42 | $index = $version.IndexOf(".")
43 | if ($index -ge 0) {
44 |     [int]$windows = [int]$version.Substring(0, $index)
45 | } else {
46 |     Write-Error "Invalid version format"
47 |     exit
48 | }
49 | 
50 | # Copy the appropriate logs based on Windows version
51 | if ($windows -lt 6) {
52 |     Copy-Item -Force -Recurse -Verbose $EVTsourceDirectory -Destination $destinationDirectory -ErrorAction Stop
53 | } else {
54 |     Copy-Item -Force -Recurse -Verbose $EVTXsourceDirectory -Destination $destinationDirectory -ErrorAction Stop
55 | }
56 | 
57 | # Start the archive procedure and save the output to destination directory
58 | Zip-Files $zipfilename $destinationDirectory $true
59 | 
60 | # Cleanup temp files
61 | Remove-Item -LiteralPath $destinationDirectory -Force -Recurse


--------------------------------------------------------------------------------
/python/sysinfo.py:
--------------------------------------------------------------------------------
  1 | # Does not work on M1/M2 Macs
  2 | 
  3 | import psutil
  4 | import platform
  5 | from datetime import datetime
  6 | 
  7 | def get_size(bytes, suffix="B"):
  8 |     """
  9 |     Scale bytes to its proper format
 10 |     e.g:
 11 |         1253656 => '1.20MB'
 12 |         1253656678 => '1.17GB'
 13 |     """
 14 |     factor = 1024
 15 |     for unit in ["", "K", "M", "G", "T", "P"]:
 16 |         if bytes < factor:
 17 |             return f"{bytes:.2f}{unit}{suffix}"
 18 |         bytes /= factor
 19 | 
 20 | print("="*40, "System Information", "="*40)
 21 | uname = platform.uname()
 22 | print(f"System: {uname.system}")
 23 | print(f"Node Name: {uname.node}")
 24 | print(f"Release: {uname.release}")
 25 | print(f"Version: {uname.version}")
 26 | print(f"Machine: {uname.machine}")
 27 | print(f"Processor: {uname.processor}")
 28 | 
 29 | # Boot Time
 30 | print("="*40, "Boot Time", "="*40)
 31 | boot_time_timestamp = psutil.boot_time()
 32 | bt = datetime.fromtimestamp(boot_time_timestamp)
 33 | print(f"Boot Time: {bt.year}/{bt.month}/{bt.day} {bt.hour}:{bt.minute}:{bt.second}")
 34 | 
 35 | # let's print CPU information
 36 | print("="*40, "CPU Info", "="*40)
 37 | # number of cores
 38 | print("Physical cores:", psutil.cpu_count(logical=False))
 39 | print("Total cores:", psutil.cpu_count(logical=True))
 40 | # CPU frequencies
 41 | cpufreq = psutil.cpu_freq()
 42 | print(f"Max Frequency: {cpufreq.max:.2f}Mhz")
 43 | print(f"Min Frequency: {cpufreq.min:.2f}Mhz")
 44 | print(f"Current Frequency: {cpufreq.current:.2f}Mhz")
 45 | # CPU usage
 46 | print("CPU Usage Per Core:")
 47 | for i, percentage in enumerate(psutil.cpu_percent(percpu=True, interval=1)):
 48 |     print(f"Core {i}: {percentage}%")
 49 | print(f"Total CPU Usage: {psutil.cpu_percent()}%")
 50 | 
 51 | # Memory Information
 52 | print("="*40, "Memory Information", "="*40)
 53 | # get the memory details
 54 | svmem = psutil.virtual_memory()
 55 | print(f"Total: {get_size(svmem.total)}")
 56 | print(f"Available: {get_size(svmem.available)}")
 57 | print(f"Used: {get_size(svmem.used)}")
 58 | print(f"Percentage: {svmem.percent}%")
 59 | print("="*20, "SWAP", "="*20)
 60 | # get the swap memory details (if exists)
 61 | swap = psutil.swap_memory()
 62 | print(f"Total: {get_size(swap.total)}")
 63 | print(f"Free: {get_size(swap.free)}")
 64 | print(f"Used: {get_size(swap.used)}")
 65 | print(f"Percentage: {swap.percent}%")
 66 | 
 67 | # Disk Information
 68 | print("="*40, "Disk Information", "="*40)
 69 | print("Partitions and Usage:")
 70 | # get all disk partitions
 71 | partitions = psutil.disk_partitions()
 72 | for partition in partitions:
 73 |     print(f"=== Device: {partition.device} ===")
 74 |     print(f"  Mountpoint: {partition.mountpoint}")
 75 |     print(f"  File system type: {partition.fstype}")
 76 |     try:
 77 |         partition_usage = psutil.disk_usage(partition.mountpoint)
 78 |     except PermissionError:
 79 |         # this can be catched due to the disk that
 80 |         # isn't ready
 81 |         continue
 82 |     print(f"  Total Size: {get_size(partition_usage.total)}")
 83 |     print(f"  Used: {get_size(partition_usage.used)}")
 84 |     print(f"  Free: {get_size(partition_usage.free)}")
 85 |     print(f"  Percentage: {partition_usage.percent}%")
 86 | # get IO statistics since boot
 87 | disk_io = psutil.disk_io_counters()
 88 | print(f"Total read: {get_size(disk_io.read_bytes)}")
 89 | print(f"Total write: {get_size(disk_io.write_bytes)}")
 90 | 
 91 | # Network information
 92 | print("="*40, "Network Information", "="*40)
 93 | # get all network interfaces (virtual and physical)
 94 | if_addrs = psutil.net_if_addrs()
 95 | for interface_name, interface_addresses in if_addrs.items():
 96 |     for address in interface_addresses:
 97 |         print(f"=== Interface: {interface_name} ===")
 98 |         if str(address.family) == 'AddressFamily.AF_INET':
 99 |             print(f"  IP Address: {address.address}")
100 |             print(f"  Netmask: {address.netmask}")
101 |             print(f"  Broadcast IP: {address.broadcast}")
102 |         elif str(address.family) == 'AddressFamily.AF_PACKET':
103 |             print(f"  MAC Address: {address.address}")
104 |             print(f"  Netmask: {address.netmask}")
105 |             print(f"  Broadcast MAC: {address.broadcast}")
106 | # get IO statistics since boot
107 | net_io = psutil.net_io_counters()
108 | print(f"Total Bytes Sent: {get_size(net_io.bytes_sent)}")
109 | print(f"Total Bytes Received: {get_size(net_io.bytes_recv)}")


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                                  Apache License
  2 |                            Version 2.0, January 2004
  3 |                         http://www.apache.org/licenses/
  4 | 
  5 |    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
  6 | 
  7 |    1. Definitions.
  8 | 
  9 |       "License" shall mean the terms and conditions for use, reproduction,
 10 |       and distribution as defined by Sections 1 through 9 of this document.
 11 | 
 12 |       "Licensor" shall mean the copyright owner or entity authorized by
 13 |       the copyright owner that is granting the License.
 14 | 
 15 |       "Legal Entity" shall mean the union of the acting entity and all
 16 |       other entities that control, are controlled by, or are under common
 17 |       control with that entity. For the purposes of this definition,
 18 |       "control" means (i) the power, direct or indirect, to cause the
 19 |       direction or management of such entity, whether by contract or
 20 |       otherwise, or (ii) ownership of fifty percent (50%) or more of the
 21 |       outstanding shares, or (iii) beneficial ownership of such entity.
 22 | 
 23 |       "You" (or "Your") shall mean an individual or Legal Entity
 24 |       exercising permissions granted by this License.
 25 | 
 26 |       "Source" form shall mean the preferred form for making modifications,
 27 |       including but not limited to software source code, documentation
 28 |       source, and configuration files.
 29 | 
 30 |       "Object" form shall mean any form resulting from mechanical
 31 |       transformation or translation of a Source form, including but
 32 |       not limited to compiled object code, generated documentation,
 33 |       and conversions to other media types.
 34 | 
 35 |       "Work" shall mean the work of authorship, whether in Source or
 36 |       Object form, made available under the License, as indicated by a
 37 |       copyright notice that is included in or attached to the work
 38 |       (an example is provided in the Appendix below).
 39 | 
 40 |       "Derivative Works" shall mean any work, whether in Source or Object
 41 |       form, that is based on (or derived from) the Work and for which the
 42 |       editorial revisions, annotations, elaborations, or other modifications
 43 |       represent, as a whole, an original work of authorship. For the purposes
 44 |       of this License, Derivative Works shall not include works that remain
 45 |       separable from, or merely link (or bind by name) to the interfaces of,
 46 |       the Work and Derivative Works thereof.
 47 | 
 48 |       "Contribution" shall mean any work of authorship, including
 49 |       the original version of the Work and any modifications or additions
 50 |       to that Work or Derivative Works thereof, that is intentionally
 51 |       submitted to Licensor for inclusion in the Work by the copyright owner
 52 |       or by an individual or Legal Entity authorized to submit on behalf of
 53 |       the copyright owner. For the purposes of this definition, "submitted"
 54 |       means any form of electronic, verbal, or written communication sent
 55 |       to the Licensor or its representatives, including but not limited to
 56 |       communication on electronic mailing lists, source code control systems,
 57 |       and issue tracking systems that are managed by, or on behalf of, the
 58 |       Licensor for the purpose of discussing and improving the Work, but
 59 |       excluding communication that is conspicuously marked or otherwise
 60 |       designated in writing by the copyright owner as "Not a Contribution."
 61 | 
 62 |       "Contributor" shall mean Licensor and any individual or Legal Entity
 63 |       on behalf of whom a Contribution has been received by Licensor and
 64 |       subsequently incorporated within the Work.
 65 | 
 66 |    2. Grant of Copyright License. Subject to the terms and conditions of
 67 |       this License, each Contributor hereby grants to You a perpetual,
 68 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 69 |       copyright license to reproduce, prepare Derivative Works of,
 70 |       publicly display, publicly perform, sublicense, and distribute the
 71 |       Work and such Derivative Works in Source or Object form.
 72 | 
 73 |    3. Grant of Patent License. Subject to the terms and conditions of
 74 |       this License, each Contributor hereby grants to You a perpetual,
 75 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 76 |       (except as stated in this section) patent license to make, have made,
 77 |       use, offer to sell, sell, import, and otherwise transfer the Work,
 78 |       where such license applies only to those patent claims licensable
 79 |       by such Contributor that are necessarily infringed by their
 80 |       Contribution(s) alone or by combination of their Contribution(s)
 81 |       with the Work to which such Contribution(s) was submitted. If You
 82 |       institute patent litigation against any entity (including a
 83 |       cross-claim or counterclaim in a lawsuit) alleging that the Work
 84 |       or a Contribution incorporated within the Work constitutes direct
 85 |       or contributory patent infringement, then any patent licenses
 86 |       granted to You under this License for that Work shall terminate
 87 |       as of the date such litigation is filed.
 88 | 
 89 |    4. Redistribution. You may reproduce and distribute copies of the
 90 |       Work or Derivative Works thereof in any medium, with or without
 91 |       modifications, and in Source or Object form, provided that You
 92 |       meet the following conditions:
 93 | 
 94 |       (a) You must give any other recipients of the Work or
 95 |           Derivative Works a copy of this License; and
 96 | 
 97 |       (b) You must cause any modified files to carry prominent notices
 98 |           stating that You changed the files; and
 99 | 
100 |       (c) You must retain, in the Source form of any Derivative Works
101 |           that You distribute, all copyright, patent, trademark, and
102 |           attribution notices from the Source form of the Work,
103 |           excluding those notices that do not pertain to any part of
104 |           the Derivative Works; and
105 | 
106 |       (d) If the Work includes a "NOTICE" text file as part of its
107 |           distribution, then any Derivative Works that You distribute must
108 |           include a readable copy of the attribution notices contained
109 |           within such NOTICE file, excluding those notices that do not
110 |           pertain to any part of the Derivative Works, in at least one
111 |           of the following places: within a NOTICE text file distributed
112 |           as part of the Derivative Works; within the Source form or
113 |           documentation, if provided along with the Derivative Works; or,
114 |           within a display generated by the Derivative Works, if and
115 |           wherever such third-party notices normally appear. The contents
116 |           of the NOTICE file are for informational purposes only and
117 |           do not modify the License. You may add Your own attribution
118 |           notices within Derivative Works that You distribute, alongside
119 |           or as an addendum to the NOTICE text from the Work, provided
120 |           that such additional attribution notices cannot be construed
121 |           as modifying the License.
122 | 
123 |       You may add Your own copyright statement to Your modifications and
124 |       may provide additional or different license terms and conditions
125 |       for use, reproduction, or distribution of Your modifications, or
126 |       for any such Derivative Works as a whole, provided Your use,
127 |       reproduction, and distribution of the Work otherwise complies with
128 |       the conditions stated in this License.
129 | 
130 |    5. Submission of Contributions. Unless You explicitly state otherwise,
131 |       any Contribution intentionally submitted for inclusion in the Work
132 |       by You to the Licensor shall be under the terms and conditions of
133 |       this License, without any additional terms or conditions.
134 |       Notwithstanding the above, nothing herein shall supersede or modify
135 |       the terms of any separate license agreement you may have executed
136 |       with Licensor regarding such Contributions.
137 | 
138 |    6. Trademarks. This License does not grant permission to use the trade
139 |       names, trademarks, service marks, or product names of the Licensor,
140 |       except as required for reasonable and customary use in describing the
141 |       origin of the Work and reproducing the content of the NOTICE file.
142 | 
143 |    7. Disclaimer of Warranty. Unless required by applicable law or
144 |       agreed to in writing, Licensor provides the Work (and each
145 |       Contributor provides its Contributions) on an "AS IS" BASIS,
146 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 |       implied, including, without limitation, any warranties or conditions
148 |       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 |       PARTICULAR PURPOSE. You are solely responsible for determining the
150 |       appropriateness of using or redistributing the Work and assume any
151 |       risks associated with Your exercise of permissions under this License.
152 | 
153 |    8. Limitation of Liability. In no event and under no legal theory,
154 |       whether in tort (including negligence), contract, or otherwise,
155 |       unless required by applicable law (such as deliberate and grossly
156 |       negligent acts) or agreed to in writing, shall any Contributor be
157 |       liable to You for damages, including any direct, indirect, special,
158 |       incidental, or consequential damages of any character arising as a
159 |       result of this License or out of the use or inability to use the
160 |       Work (including but not limited to damages for loss of goodwill,
161 |       work stoppage, computer failure or malfunction, or any and all
162 |       other commercial damages or losses), even if such Contributor
163 |       has been advised of the possibility of such damages.
164 | 
165 |    9. Accepting Warranty or Additional Liability. While redistributing
166 |       the Work or Derivative Works thereof, You may choose to offer,
167 |       and charge a fee for, acceptance of support, warranty, indemnity,
168 |       or other liability obligations and/or rights consistent with this
169 |       License. However, in accepting such obligations, You may act only
170 |       on Your own behalf and on Your sole responsibility, not on behalf
171 |       of any other Contributor, and only if You agree to indemnify,
172 |       defend, and hold each Contributor harmless for any liability
173 |       incurred by, or claims asserted against, such Contributor by reason
174 |       of your accepting any such warranty or additional liability.
175 | 
176 |    END OF TERMS AND CONDITIONS
177 | 
178 |    APPENDIX: How to apply the Apache License to your work.
179 | 
180 |       To apply the Apache License to your work, attach the following
181 |       boilerplate notice, with the fields enclosed by brackets "[]"
182 |       replaced with your own identifying information. (Don't include
183 |       the brackets!)  The text should be enclosed in the appropriate
184 |       comment syntax for the file format. We also recommend that a
185 |       file or class name and description of purpose be included on the
186 |       same "printed page" as the copyright notice for easier
187 |       identification within third-party archives.
188 | 
189 |    Copyright [2023] [Trend Micro]
190 | 
191 |    Licensed under the Apache License, Version 2.0 (the "License");
192 |    you may not use this file except in compliance with the License.
193 |    You may obtain a copy of the License at
194 | 
195 |        http://www.apache.org/licenses/LICENSE-2.0
196 | 
197 |    Unless required by applicable law or agreed to in writing, software
198 |    distributed under the License is distributed on an "AS IS" BASIS,
199 |    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 |    See the License for the specific language governing permissions and
201 |    limitations under the License.
202 | 


--------------------------------------------------------------------------------