From 8d67c62ca63e9051d59789c2266e6befe7c9fc1d Mon Sep 17 00:00:00 2001 From: DISKonnectd Date: Fri, 15 Jan 2016 15:24:51 -0500 Subject: [PATCH 1/3] Create Get-RegistryKeyValData.ps1 Retrieves key value and date modified --- Modules/Log/Get-RegistryKeyValData.ps1 | 169 +++++++++++++++++++++++++ 1 file changed, 169 insertions(+) create mode 100644 Modules/Log/Get-RegistryKeyValData.ps1 diff --git a/Modules/Log/Get-RegistryKeyValData.ps1 b/Modules/Log/Get-RegistryKeyValData.ps1 new file mode 100644 index 00000000..a745b986 --- /dev/null +++ b/Modules/Log/Get-RegistryKeyValData.ps1 @@ -0,0 +1,169 @@ +<# +.SYNOPSIS +Get-RegistryKeyValData.ps1 retrieves the value of the provided key as +well as the last modified time of the key. + +.NOTES +Next line needed by Kansa.ps1 for proper handling of this script's data +OUTPUT tsv + +HKEY_LOCAL_MACHINE +HKEY_USERS +HKEY_CURRENT_USER is a subkey of HKEY_USERS +HKEY_CURRENT_CONFIG is a subkey (HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current) +HKEY_CLASSES_ROOT is a subkey (HKEY_LOCAL_MACHINE\SOFTWARE\Classes) +#> +param( +[string]$Key +) + +$Error.Clear() +$ErrorActionPreference = "SilentlyContinue" + +## The following code is from +## Name: Get-RegistryKeyTimestamp +## Author: Boe Prox +## Version History: +## 1.0 -- Boe Prox 17 Dec 2014 +## -Initial Build +#region Create Win32 API Object +Try { + [void][advapi32] +} + +Catch { + #region Module Builder + $Domain = [AppDomain]::CurrentDomain + $DynAssembly = New-Object System.Reflection.AssemblyName('RegAssembly') + $AssemblyBuilder = $Domain.DefineDynamicAssembly($DynAssembly, [System.Reflection.Emit.AssemblyBuilderAccess]::Run) # Only run in memory + $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule('RegistryTimeStampModule', $False) + #endregion Module Builder + + #region DllImport + $TypeBuilder = $ModuleBuilder.DefineType('advapi32', 'Public, Class') + + #region RegQueryInfoKey Method + $PInvokeMethod = $TypeBuilder.DefineMethod( + 'RegQueryInfoKey', #Method Name + [Reflection.MethodAttributes] 'PrivateScope, Public, Static, HideBySig, PinvokeImpl', #Method Attributes + [IntPtr], #Method Return Type + [Type[]] @( + [Microsoft.Win32.SafeHandles.SafeRegistryHandle], #Registry Handle + [System.Text.StringBuilder], #Class Name + [UInt32 ].MakeByRefType(), #Class Length + [UInt32], #Reserved + [UInt32 ].MakeByRefType(), #Subkey Count + [UInt32 ].MakeByRefType(), #Max Subkey Name Length + [UInt32 ].MakeByRefType(), #Max Class Length + [UInt32 ].MakeByRefType(), #Value Count + [UInt32 ].MakeByRefType(), #Max Value Name Length + [UInt32 ].MakeByRefType(), #Max Value Name Length + [UInt32 ].MakeByRefType(), #Security Descriptor Size + [long].MakeByRefType() #LastWriteTime + ) #Method Parameters + ) + + $DllImportConstructor = [Runtime.InteropServices.DllImportAttribute].GetConstructor(@([String])) + $FieldArray = [Reflection.FieldInfo[]] @( + [Runtime.InteropServices.DllImportAttribute].GetField('EntryPoint'), + [Runtime.InteropServices.DllImportAttribute].GetField('SetLastError') + ) + + $FieldValueArray = [Object[]] @( + 'RegQueryInfoKey', #CASE SENSITIVE!! + $True + ) + + $SetLastErrorCustomAttribute = New-Object Reflection.Emit.CustomAttributeBuilder( + $DllImportConstructor, + @('advapi32.dll'), + $FieldArray, + $FieldValueArray + ) + + $PInvokeMethod.SetCustomAttribute($SetLastErrorCustomAttribute) + #endregion RegQueryInfoKey Method + + [void]$TypeBuilder.CreateType() + #endregion DllImport +} ## End of Name: Get-RegistryKeyTimestamp + +# Test to make sure the provide key is valid. +Try{ + # If valid, get property and set RegistryKey value + If (test-path -Path registry::$Key) { + Get-ItemProperty -Path Registry::$Key + $RegistryKey = Get-Item -Path Registry::$Key + + ## The following code is from + ## Name: Get-RegistryKeyTimestamp + ## Author: Boe Prox + ## Version History: + ## 1.0 -- Boe Prox 17 Dec 2014 + ## -Initial Build + #region Constant Variables + $ClassLength = 255 + [long]$TimeStamp = $null + #endregion Constant Variables + + $ClassName = New-Object System.Text.StringBuilder $RegistryKey.Name + $RegistryHandle = $RegistryKey.Handle + #endregion Registry Key Data + + #region Retrieve timestamp + $Return = [advapi32]::RegQueryInfoKey( + $RegistryHandle, + $ClassName, + [ref]$ClassLength, + $Null, + [ref]$Null, + [ref]$Null, + [ref]$Null, + [ref]$Null, + [ref]$Null, + [ref]$Null, + [ref]$Null, + [ref]$TimeStamp + ) + Switch ($Return) { + 0 { + #Convert High/Low date to DateTime Object + $LastWriteTime = [datetime]::FromFileTime($TimeStamp) + + #Return object + $Object = [pscustomobject]@{ + FullName = $RegistryKey.Name + Name = $RegistryKey.Name -replace '.*\\(.*)','$1' + LastWriteTime = $LastWriteTime + } + $Object.pstypenames.insert(0,'Microsoft.Registry.Timestamp') + $Object + } + 122 { + Throw "ERROR_INSUFFICIENT_BUFFER (0x7a)" + } + Default { + Throw "Error ($return) occurred" + } + } + #endregion Retrieve timestamp + ## End of Name: Get-RegistryKeyTimestamp + } + # if not, write error message + else { + Write-Error -Message "Key does not exist" + } +} + +# If for some reason everything fails, write error message +Catch{ + Write-Error -Message "Unable to retrieve data from registry" +} + +if ($Error) { + # Write the $Error to the $Errorlog + Write-Error "Get-RegistryKeyValData Error on $env:COMPUTERNAME" + Write-Error $Error + $Error.Clear() +} +Write-Debug "Exiting $($MyInvocation.MyCommand)" From 99797c8b9e16da5a03af90a4b77f3e7742d98b7c Mon Sep 17 00:00:00 2001 From: DISKonnectd Date: Fri, 15 Jan 2016 15:55:40 -0500 Subject: [PATCH 2/3] Moved file --- Modules/Log/Get-OfficeMRU.ps1 | 71 +++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 Modules/Log/Get-OfficeMRU.ps1 diff --git a/Modules/Log/Get-OfficeMRU.ps1 b/Modules/Log/Get-OfficeMRU.ps1 new file mode 100644 index 00000000..0174cb2c --- /dev/null +++ b/Modules/Log/Get-OfficeMRU.ps1 @@ -0,0 +1,71 @@ +<# +.SYNOPSIS +Get-OfficeMRU.ps1 acquires Microsoft Office MRU from registry +and reformats on the target as tsv output. + +.NOTES +Next line needed by Kansa.ps1 for proper handling of this script's data +OUTPUT tsv +#> + +# versions of Microsoft office +$office_versions = @("15.0", #2013 + "14.0", #2010 + "11.0", #2003 + "10.0", #2002 + "9.0" #2000 + ) + + +# get a list of all users on the computer +Try { + $user_SIDs = gwmi win32_userprofile | select sid +} +Catch{ + $user_SIDs = @() + Write-Error -Message "Unable to obtain SID list" +} + +# If anything goes wrong with checking the registry, exit without +# killing the rest of the program +Try { + # loop through each user in the registry to get records + Foreach ($user_SID in $user_SIDs.sid){ + + # loop through the array for all versions of Microsoft Office + Foreach ($version in $office_versions){ + + # sets the base path in the registry based on the user SID + $key_base = "\HKEY_USERS\" + $user_SID + "\software\microsoft\office\" + $version +"\" + + # test the office version, if it exists, continue + If (test-path -Path registry::$key_base) { + + # gets the MRU files for each office app installed + $office_key_ring = Get-ChildItem -Path Registry::$key_base + + # check each key for MRU entries + ForEach ($office_key in $office_key_ring){ + $office_app_key = $office_key.name + "\user mru" + + # check to see if the app (Word, Excel, etc) has a MRU key + if (test-path -Path Registry::$office_app_key) { + + # since the subkey has a random name, we need to cycle through each entry + $office_app_mru_key = Get-ChildItem -Path Registry::$office_app_key; + + # this subkey should contain the File and Place MRU entries we want + # to extract the data from + ForEach ($mru_key in (Get-ChildItem -Path Registry::$office_app_mru_key)){ + $item = Get-ItemProperty -Path Registry::$mru_key + $item + } + } + } + } + } + } + +Catch{ + Write-Error -Message "Unable to retrieve data from registry" +} From ef1a6208cb2a8cafacc7fc28483260d804f44c15 Mon Sep 17 00:00:00 2001 From: DISKonnectd Date: Fri, 15 Jan 2016 16:01:13 -0500 Subject: [PATCH 3/3] Delete Get-OfficeMRU.ps1 --- Get-OfficeMRU.ps1 | 71 ----------------------------------------------- 1 file changed, 71 deletions(-) delete mode 100644 Get-OfficeMRU.ps1 diff --git a/Get-OfficeMRU.ps1 b/Get-OfficeMRU.ps1 deleted file mode 100644 index 0174cb2c..00000000 --- a/Get-OfficeMRU.ps1 +++ /dev/null @@ -1,71 +0,0 @@ -<# -.SYNOPSIS -Get-OfficeMRU.ps1 acquires Microsoft Office MRU from registry -and reformats on the target as tsv output. - -.NOTES -Next line needed by Kansa.ps1 for proper handling of this script's data -OUTPUT tsv -#> - -# versions of Microsoft office -$office_versions = @("15.0", #2013 - "14.0", #2010 - "11.0", #2003 - "10.0", #2002 - "9.0" #2000 - ) - - -# get a list of all users on the computer -Try { - $user_SIDs = gwmi win32_userprofile | select sid -} -Catch{ - $user_SIDs = @() - Write-Error -Message "Unable to obtain SID list" -} - -# If anything goes wrong with checking the registry, exit without -# killing the rest of the program -Try { - # loop through each user in the registry to get records - Foreach ($user_SID in $user_SIDs.sid){ - - # loop through the array for all versions of Microsoft Office - Foreach ($version in $office_versions){ - - # sets the base path in the registry based on the user SID - $key_base = "\HKEY_USERS\" + $user_SID + "\software\microsoft\office\" + $version +"\" - - # test the office version, if it exists, continue - If (test-path -Path registry::$key_base) { - - # gets the MRU files for each office app installed - $office_key_ring = Get-ChildItem -Path Registry::$key_base - - # check each key for MRU entries - ForEach ($office_key in $office_key_ring){ - $office_app_key = $office_key.name + "\user mru" - - # check to see if the app (Word, Excel, etc) has a MRU key - if (test-path -Path Registry::$office_app_key) { - - # since the subkey has a random name, we need to cycle through each entry - $office_app_mru_key = Get-ChildItem -Path Registry::$office_app_key; - - # this subkey should contain the File and Place MRU entries we want - # to extract the data from - ForEach ($mru_key in (Get-ChildItem -Path Registry::$office_app_mru_key)){ - $item = Get-ItemProperty -Path Registry::$mru_key - $item - } - } - } - } - } - } - -Catch{ - Write-Error -Message "Unable to retrieve data from registry" -}