Merge pull request #21 from CrowdStrike/develop

v1.1.0 Merge development into master

CustomActions/CustomAction.config

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8" ?>
+<configuration>
+    <startup useLegacyV2RuntimeActivationPolicy="true">
+
+        <!--
+          Use supportedRuntime tags to explicitly specify the version(s) of the .NET Framework runtime that
+          the custom action should run on. If no versions are specified, the chosen version of the runtime
+          will be the "best" match to what Microsoft.Deployment.WindowsInstaller.dll was built against.
+
+          WARNING: leaving the version unspecified is dangerous as it introduces a risk of compatibility
+          problems with future versions of the .NET Framework runtime. It is highly recommended that you specify
+          only the version(s) of the .NET Framework runtime that you have tested against.
+
+          Note for .NET Framework v3.0 and v3.5, the runtime version is still v2.0.
+
+          In order to enable .NET Framework version 2.0 runtime activation policy, which is to load all assemblies 
+          by using the latest supported runtime, @useLegacyV2RuntimeActivationPolicy="true".
+
+          For more information, see http://msdn.microsoft.com/en-us/library/bbx34a2h.aspx
+        -->
+
+        <supportedRuntime version="v4.0" />
+        <supportedRuntime version="v2.0.50727"/>
+
+    </startup>
+
+    <!--
+      Add additional configuration settings here. For more information on application config files,
+      see http://msdn.microsoft.com/en-us/library/kza1yk3a.aspx
+    -->
+
+</configuration>

CustomActions/CustomAction.cs

@@ -0,0 +1,18 @@
+using System;
+using System.Collections.Generic;
+using System.Text;
+using Microsoft.Deployment.WindowsInstaller;
+
+namespace CustomActions
+{
+    public class CustomActions
+    {
+        [CustomAction]
+        public static ActionResult CustomAction1(Session session)
+        {
+            session.Log("Begin CustomAction1");
+
+            return ActionResult.Success;
+        }
+    }
+}

CustomActions/CustomActions.csproj

@@ -0,0 +1,51 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">x86</Platform>
+    <ProductVersion>8.0.30703</ProductVersion>
+    <SchemaVersion>2.0</SchemaVersion>
+    <ProjectGuid>{908B9867-AD1B-406B-B1FA-03DA91C0A72A}</ProjectGuid>
+    <OutputType>Library</OutputType>
+    <AppDesignerFolder>Properties</AppDesignerFolder>
+    <RootNamespace>CustomActions</RootNamespace>
+    <AssemblyName>CustomActions</AssemblyName>
+    <TargetFrameworkVersion>v4.5.2</TargetFrameworkVersion>
+    <FileAlignment>512</FileAlignment>
+    <WixCATargetsPath Condition=" '$(WixCATargetsPath)' == '' ">$(MSBuildExtensionsPath)\Microsoft\WiX\v3.x\Wix.CA.targets</WixCATargetsPath>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|x86' ">
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|x86' ">
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Xml.Linq" />
+    <Reference Include="Microsoft.CSharp" />
+    <Reference Include="System.Xml" />
+    <Reference Include="Microsoft.Deployment.WindowsInstaller">
+      <Private>True</Private>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="CustomAction.cs" />
+    <Compile Include="Properties\AssemblyInfo.cs" />
+    <Content Include="CustomAction.config" />
+  </ItemGroup>
+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+  <Import Project="$(WixCATargetsPath)" />
+</Project>

CustomActions/Properties/AssemblyInfo.cs

@@ -0,0 +1,35 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// General Information about an assembly is controlled through the following 
+// set of attributes. Change these attribute values to modify the information
+// associated with an assembly.
+[assembly: AssemblyTitle("CustomActions")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("CustomActions")]
+[assembly: AssemblyCopyright("Copyright ©  2016")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// Setting ComVisible to false makes the types in this assembly not visible 
+// to COM components.  If you need to access a type in this assembly from 
+// COM, set the ComVisible attribute to true on that type.
+[assembly: ComVisible(false)]
+
+// The following GUID is for the ID of the typelib if this project is exposed to COM
+[assembly: Guid("908b9867-ad1b-406b-b1fa-03da91c0a72a")]
+
+// Version information for an assembly consists of the following four values:
+//
+//      Major Version
+//      Minor Version 
+//      Build Number
+//      Revision
+//
+// You can specify all the values or you can default the Build and Revision Numbers 
+// by using the '*' as shown below:
+// [assembly: AssemblyVersion("1.0.*")]
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]

FalconOrchestrator.Forensics/FalconOrchestrator.Forensics.csproj

@@ -49,10 +49,13 @@
   <ItemGroup>
     <Compile Include="FileSystemBrowser.cs" />
     <Compile Include="FileExtraction.cs" />
+    <Compile Include="Memory.cs" />
+    <Compile Include="ProcessManagement.cs" />
     <Compile Include="PSRemoting.cs" />
     <Compile Include="Models.cs" />
     <Compile Include="Properties\AssemblyInfo.cs" />
     <Compile Include="SoftwareManagement.cs" />
+    <Compile Include="SystemRestore.cs" />
   </ItemGroup>
   <ItemGroup>
     <None Include="packages.config" />

FalconOrchestrator.Forensics/FileExtraction.cs

@@ -66,17 +66,4 @@ public Dictionary<string,string> GetDevicePaths(string command)
             return result;
         }
     }
-
-    public class FileMetadata
-    {
-        public string CreationTime { get; set; }
-        public string LastAccessTime { get; set; }
-        public string LastWriteTime { get; set; }
-        public string Attributes { get; set; }
-        public string DirectoryName { get; set; }
-        public string Name { get; set; }
-        public string FullName { get; set; }
-        public string Extension { get; set; }
-        public string Length { get; set; }
-    }
 }

FalconOrchestrator.Forensics/FileSystemBrowser.cs

@@ -56,5 +56,27 @@ public List<FileMetadata> GetDirectoryContent(string path)
             return files;
 
         }
+
+        public bool CheckFileExists(string path)
+        {
+            foreach (PSObject line in _psr.ExecuteCommand("Test-Path \"" + path + "\""))
+            {
+                return System.Convert.ToBoolean(line.ToString());
+            }
+            return false;
+        }
+
+        public void DeleteFile(string path)
+        {
+            _psr.ExecuteCommand("Remove-Item " + path + " -Recurse -Force");
+        }
+
+        public void CopyFile(string source, string destination)
+        {
+            _psr.ExecuteCommand("Copy-Item -Recurse -Force -Path \"" + source + "\" -Destination \"" + destination + "\"");
+        }
+
+
+
     }
 }

FalconOrchestrator.Forensics/Memory.cs

@@ -0,0 +1,34 @@
+//<Falcon Orchestrator provides automated workflow and response capabilities>
+//    Copyright(C) 2016 CrowdStrike
+
+//   This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License as
+//    published by the Free Software Foundation, either version 3 of the
+//    License, or(at your option) any later version.
+
+//   This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
+//    GNU Affero General Public License for more details.
+
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program.If not, see<http://www.gnu.org/licenses/>.
+
+
+namespace FalconOrchestrator.Forensics
+{
+    public class Memory
+    {
+        private PSRemoting _psr;
+
+        public Memory(PSRemoting psr)
+        {
+            _psr = psr;
+        }
+
+        public void ProcessDump(string command)
+        {
+            _psr.ExecuteCommand(command);
+        }
+    }
+}

FalconOrchestrator.Forensics/Models.cs

@@ -16,17 +16,42 @@
 
 
 using System;
+using System.Collections.Generic;
+using Newtonsoft.Json;
 
 namespace FalconOrchestrator.Forensics
 {
-    public class SystemRestorePoints
+    public class SystemRestorePoint
     {
-        public DateTime CreationTime { get; set; }
+        public string CreationTime { get; set; }
         public string Description { get; set; }
         public string SequenceNumber { get; set; }
         public string EventType { get; set; }
         public string RestorePointType { get; set; }
+
+        public DateTime CreationTimeDateTime
+        {
+            get
+            {
+                return DateTime.ParseExact(CreationTime.Split('-')[0], "yyyyMMddHHmmss.ffffff", null);
+            }
+        }
     }
+    public class ShadowCopy
+    {
+        public string ID { get; set; }
+        public string DeviceObject { get; set; }
+        public string InstallDate { get; set; }
+
+        public DateTime InstallDateTime
+        {
+            get
+            {
+                return DateTime.ParseExact(InstallDate.Split('-')[0], "yyyyMMddHHmmss.ffffff", null).ToUniversalTime();
+            }
+        }
+    }
+
 
     public class InstalledSoftware
     {
@@ -38,4 +63,42 @@ public class InstalledSoftware
         public string UninstallKey { get; set; }
         public string Guid { get; set; }
     }
-}
+
+    public class Process
+    {
+        public int Id { get; set; }
+        public uint ParentProcessId { get; set; }
+        public string Name { get; set; }
+        public string Company { get; set; }
+        public string Owner { get; set; }
+        public string Path { get; set; }
+        public string ProductVersion { get; set; }
+        public string Description { get; set; }
+        public DateTime StartTime { get; set; }
+        public string CommandLine { get; set; }
+        public double CPU { get; set; }
+        public int HandleCount { get; set; }
+        public int PagedMemorySize { get; set; }
+        public int PagedSystemMemorySize { get; set; }
+        public int PrivateMemorySize { get; set; }
+        public int VirtualMemorySize { get; set; }
+        public int NonpagedSystemMemorySize { get; set; }
+        public int PeakPagedMemorySize { get; set; }
+        public int PeakWorkingSet { get; set; }
+        public int PeakVirtualMemorySize { get; set; }
+        public int WorkingSet { get; set; }
+    }
+
+    public class FileMetadata
+    {
+        public string CreationTime { get; set; }
+        public string LastAccessTime { get; set; }
+        public string LastWriteTime { get; set; }
+        public string Attributes { get; set; }
+        public string DirectoryName { get; set; }
+        public string Name { get; set; }
+        public string FullName { get; set; }
+        public string Extension { get; set; }
+        public string Length { get; set; }
+    }
+}

FalconOrchestrator.Forensics/PSRemoting.cs

@@ -94,6 +94,7 @@ public Collection<PSObject> ExecuteCommand(string command)
                 {
                     string errorOutput = null;
                     ps.Streams.Error.ToList().ForEach(x => errorOutput += x.ToString());
+                    runSpace.Close();
                     throw new Exception(errorOutput);
                 }
 

FalconOrchestrator.Forensics/ProcessManagement.cs

@@ -0,0 +1,51 @@
+//<Falcon Orchestrator provides automated workflow and response capabilities>
+//    Copyright(C) 2016 CrowdStrike
+
+//   This program is free software: you can redistribute it and/or modify
+//    it under the terms of the GNU Affero General Public License as
+//    published by the Free Software Foundation, either version 3 of the
+//    License, or(at your option) any later version.
+
+//   This program is distributed in the hope that it will be useful,
+//    but WITHOUT ANY WARRANTY; without even the implied warranty of
+//    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.See the
+//    GNU Affero General Public License for more details.
+
+//    You should have received a copy of the GNU Affero General Public License
+//    along with this program.If not, see<http://www.gnu.org/licenses/>.
+
+using System.Collections.Generic;
+using System.Linq;
+using System.Management.Automation;
+
+namespace FalconOrchestrator.Forensics
+{
+    public class ProcessManagement
+    {
+        private PSRemoting _psr;
+
+        public ProcessManagement(PSRemoting psr)
+        {
+            _psr = psr;
+        }
+
+        public List<FalconOrchestrator.Forensics.Process> ListProcesses(string command)
+        {
+            List<Process> result = new List<Process>();
+
+            foreach (PSObject line in _psr.ExecuteCommand(command))
+            {
+                Process proc = new Process();
+                line.Properties.ToList().ForEach(x => proc.GetType().GetProperty(x.Name).SetValue(proc, x.Value));
+                result.Add(proc);
+            }
+            return result;
+        }
+
+        public void Kill(int pid)
+        {
+            _psr.ExecuteCommand("Get-Process -id " + pid + " | Stop-Process -Force");
+        }
+
+    }
+}