hashSearch.ps1

# 10-02-2021 -dfir-jesseee
# For CyberForce 2021
# Get-FileHash to find a MD5 hash to put in $BadHash
# EXAMPLE:
# Get-FileHash -Algorithm MD5 .\Canary_Token_password.docx
#
$ASCII = @"
  _    _           _      _____                     _     
 | |  | |         | |    / ____|                   | |    
 | |__| | __ _ ___| |__ | (___   ___  __ _ _ __ ___| |__  
 |  __  |/ _` / __| '_ \ \___ \ / _ \/ _` | '__/ __| '_  \    By DFIR-Jesseee
 | |  | | (_| \__ \ | | |____) |  __/ (_| | | | (__| | | |
 |_|  |_|\__,_|___/_| |_|_____/ \___|\__,_|_|  \___|_| |_|
"@
#
#
$ASCII

[String]$BadHash = 'BA804B92905E08C568E303991A6CB803'
Foreach ($File In Get-ChildItem C:\users\jesse\Desktop -file -recurse)
{
    If ((Get-FileHash $File.Fullname -Algorithm MD5).Hash -EQ $BadHash)
    {
        Write-Warning "Oh no, bad file detected: $($File.Fullname)"
    }
}