LHazy

# 使用は自己責任で、一切責任は負いません。
# このプログラムは個人の利便性と参考のために公開しています。
#
# 参考情報
# https://docs.microsoft.com/en-us/windows/desktop/power/power-policy-settings
# https://devblogs.microsoft.com/scripting/use-powershell-to-detect-power-state-and-to-set-power-plan/

$powerOptionMap = @{
    Balance = "381b4222-f694-41f0-9685-ff5bb260df2e";
    Presentation = "3c0b10d2-7404-4a8a-885f-1791a2c9a075";

LHazy

enum LogCategory {
    Audit
    Signin
}

enum Sevirity {
    High
    Medium
    Low
}

LHazy

事例

Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets

• https://www.microsoft.com/en-us/security/blog/2023/09/14/peach-sandstorm-password-spray-campaigns-enable-intelligence-collection-at-high-value-targets/

Analysis of Storm-0558 techniques for unauthorized email access

• https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/

Azure Batch Misused for Crypto Mining

• https://x.com/red_cth/status/1754970064560763199
• https://dfir.ch/posts/azure_batch/

Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments

• https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF

LHazy

# !!!注意!!!:
#   このスクリプトはCドライブ配下のファイル・フォルダを探索するため「システムに負荷がかかる場合があります」
#   実行は自己責任でお願いします。
# 使い方:
#   powershell -ExecutionPolicy Bypass -File .\Scan-Bundle.ps1 <start_directory>

param(
  [Parameter(Mandatory = $true)]
  [string]$TargetDirectory
)