-
Notifications
You must be signed in to change notification settings - Fork 16
/
Copy pathexotron.bat
96 lines (85 loc) · 6.02 KB
/
exotron.bat
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
@ECHO OFF
ECHO --------------------------------------------------
ECHO EXOTRON Sandbox Feature Upgrader
timeout /t 2
:: AUDIT POLICY ADJUSTMENTS
ECHO --------------------------------------------------
ECHO Modifying the local Audit Policy
timeout /t 2
auditpol /set /subcategory:"Security State Change" /success:enable /failure:enable
auditpol /set /subcategory:"Security System Extension" /success:enable /failure:enable
auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Driver" /success:disable /failure:disable
auditpol /set /subcategory:"Other System Events" /success:disable /failure:enable
auditpol /set /subcategory:"Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Logoff" /success:enable /failure:enable
auditpol /set /subcategory:"Account Lockout" /success:enable /failure:enable
auditpol /set /subcategory:"IPsec Main Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Quick Mode" /success:disable /failure:disable
auditpol /set /subcategory:"IPsec Extended Mode" /success:disable /failure:disable
auditpol /set /subcategory:"Special Logon" /success:enable /failure:enable
auditpol /set /subcategory:"Other Logon/Logoff Events" /success:enable /failure:enable
auditpol /set /subcategory:"Network Policy Server" /success:enable /failure:enable
auditpol /set /subcategory:"File System" /success:enable /failure:enable
auditpol /set /subcategory:"Registry" /success:enable /failure:enable
auditpol /set /subcategory:"Kernel Object" /success:enable /failure:enable
auditpol /set /subcategory:"SAM" /success:disable /failure:disable
auditpol /set /subcategory:"Certification Services" /success:enable /failure:enable
auditpol /set /subcategory:"Application Generated" /success:enable /failure:enable
auditpol /set /subcategory:"Handle Manipulation" /success:disable /failure:disable
auditpol /set /subcategory:"File Share" /success:enable /failure:enable
auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:disable /failure:disable
auditpol /set /subcategory:"Filtering Platform Connection" /success:disable /failure:disable
auditpol /set /subcategory:"Other Object Access Events" /success:disable /failure:disable
auditpol /set /subcategory:"Sensitive Privilege Use" /success:disable /failure:disable
auditpol /set /subcategory:"Non Sensitive Privilege Use" /success:disable /failure:disable
auditpol /set /subcategory:"Other Privilege Use Events" /success:disable /failure:disable
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
auditpol /set /subcategory:"Process Termination" /success:enable /failure:enable
auditpol /set /subcategory:"DPAPI Activity" /success:disable /failure:disable
auditpol /set /subcategory:"RPC Events" /success:enable /failure:enable
auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Authentication Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"Authorization Policy Change" /success:enable /failure:enable
auditpol /set /subcategory:"MPSSVC Rule-Level Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Filtering Platform Policy Change" /success:disable /failure:disable
auditpol /set /subcategory:"Other Policy Change Events" /success:disable /failure:enable
auditpol /set /subcategory:"User Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Computer Account Management" /success:enable /failure:enable
auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Distribution Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Application Group Management" /success:enable /failure:enable
auditpol /set /subcategory:"Other Account Management Events" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Access" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Changes" /success:enable /failure:enable
auditpol /set /subcategory:"Directory Service Replication" /success:disable /failure:disable
auditpol /set /subcategory:"Detailed Directory Service Replication" /success:disable /failure:disable
auditpol /set /subcategory:"Credential Validation" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Service Ticket Operations" /success:enable /failure:enable
auditpol /set /subcategory:"Other Account Logon Events" /success:enable /failure:enable
auditpol /set /subcategory:"Kerberos Authentication Service" /success:enable /failure:enable
:: CLEAR EVENTLOGS
ECHO --------------------------------------------------
ECHO Clearing Eventlogs
timeout /t 2
powershell -NoProfile -ExecutionPolicy Bypass -File tools\Clear-Eventlog.ps1 -LogName Security
powershell -NoProfile -ExecutionPolicy Bypass -File tools\Clear-Eventlog.ps1 -LogName System
powershell -NoProfile -ExecutionPolicy Bypass -File tools\Clear-Eventlog.ps1 -LogName Application
REM powershell -NoProfile -ExecutionPolicy Bypass -File tools\Clear-Eventlog.ps1 -LogName "Microsoft-Windows-Sysmon/Operational"
:: SYSMON
ECHO --------------------------------------------------
ECHO Installing Sysmon
Sysmon\Sysmon.exe -u
Sysmon\Sysmon.exe -accepteula -i Sysmon\sysmonconfig-export.xml
:: SAMPLE EXECUTION
ECHO --------------------------------------------------
ECHO Executing samples in sub directory ./samples
for %%i in (samples\*) do %%i
:: EVENTLOG EXPORT
ECHO --------------------------------------------------
ECHO Exporting Eventlogs
powershell -NoProfile -ExecutionPolicy Bypass -File tools\Export-Eventlog.ps1 -LogName Security -Destination C:\eventlog-security.csv
powershell -NoProfile -ExecutionPolicy Bypass -File tools\Export-Eventlog.ps1 -LogName System -Destination C:\eventlog-system.csv
powershell -NoProfile -ExecutionPolicy Bypass -File tools\Export-Eventlog.ps1 -LogName Application -Destination C:\eventlog-application.csv
powershell -NoProfile -ExecutionPolicy Bypass -File tools\Export-Eventlog.ps1 -LogName "Microsoft-Windows-Sysmon/Operational" -Destination C:\eventlog-sysmon.csv
:: Done