47 lines
2.4 KiB
PowerShell
47 lines
2.4 KiB
PowerShell
[CmdletBinding()]
|
|
param(
|
|
[Parameter(Mandatory = $true)]
|
|
[ValidateSet("Engineer", "Site")]
|
|
[string]$Role,
|
|
[Parameter(Mandatory = $true)]
|
|
[string]$OutputDirectory
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
$resolved = [System.IO.Path]::GetFullPath($OutputDirectory)
|
|
New-Item -ItemType Directory -Force -Path $resolved | Out-Null
|
|
$stamp = (Get-Date).ToUniversalTime().ToString("yyyyMMddTHHmmssZ")
|
|
$prefix = "$stamp-$($Role.ToLowerInvariant())"
|
|
|
|
$adapters = Get-NetAdapter -IncludeHidden | Select-Object Name, InterfaceDescription, ifIndex, Status, MacAddress, LinkSpeed
|
|
$remlinkAdapters = @($adapters | Where-Object Name -eq "RemLink")
|
|
$ipConfiguration = Get-NetIPConfiguration -All | Select-Object InterfaceAlias, InterfaceIndex, IPv4Address, IPv4DefaultGateway, DNSServer
|
|
$routes = Get-NetRoute -AddressFamily IPv4 | Select-Object DestinationPrefix, NextHop, InterfaceAlias, InterfaceIndex, RouteMetric, Protocol, PolicyStore
|
|
$nat = @(Get-NetNat -ErrorAction SilentlyContinue | Select-Object Name, InternalIPInterfaceAddressPrefix, ExternalIPInterfaceAddressPrefix, Active)
|
|
$processes = Get-Process | Where-Object ProcessName -Match "RemLink|wireguard" | Select-Object ProcessName, Id, Path, StartTime
|
|
|
|
$inventory = [ordered]@{
|
|
captured_at = (Get-Date).ToUniversalTime().ToString("o")
|
|
computer = $env:COMPUTERNAME
|
|
role = $Role
|
|
elevated = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
|
|
remlink_adapter_count = $remlinkAdapters.Count
|
|
remlink_adapters = $remlinkAdapters
|
|
adapters = $adapters
|
|
ip_configuration = $ipConfiguration
|
|
ipv4_routes = $routes
|
|
existing_nat_read_only_snapshot = $nat
|
|
processes = $processes
|
|
}
|
|
$path = Join-Path $resolved "$prefix-network.json"
|
|
$inventory | ConvertTo-Json -Depth 8 | Set-Content -Encoding utf8 $path
|
|
Get-FileHash -Algorithm SHA256 $path | Format-List | Out-File -Encoding utf8 (Join-Path $resolved "$prefix-network.sha256.txt")
|
|
|
|
if ($remlinkAdapters.Count -ne 1) {
|
|
throw "Expected exactly one adapter named RemLink; found $($remlinkAdapters.Count). Evidence was saved to $path"
|
|
}
|
|
if (@($adapters | Where-Object { $_.Name -Match "WireGuard" -or $_.InterfaceDescription -Match "WireGuardNT" }).Count -ne 0) {
|
|
throw "Unexpected independent WireGuard/WireGuardNT adapter detected. Evidence was saved to $path"
|
|
}
|
|
Write-Host "Windows evidence captured: $path"
|