|
<#
Detect-Strings-Extended.ps1
Autor:
Guillermo
Objetivo:
Script INFORMÁTICO que analiza el equipo para encontrar cualquier rastro
de cadenas sospechosas en:
• Programas instalados
• Procesos en RAM
• Servicios
• Tareas programadas
• Carpetas sospechosas
• Entradas en RUN / RUNONCE
• Servicios en el Registro
• Archivos en AppData / Temp
• Programas configurados en el inicio de Windows
NO modifica nada. NO detiene nada. NO elimina nada.
#>
Write-Host
"======================================================"
-ForegroundColor Cyan
Write-Host
" ANALIZADOR DE INDICADORES - MODO
INFORMATIVO" -ForegroundColor Cyan
Write-Host
"======================================================"
-ForegroundColor Cyan
# 1) Pedir
cadenas al usuario
$input =
Read-Host "Introduce las cadenas a buscar (separadas por coma). Ej: updater, malware, test"
$patterns =
$input.Split(",") | ForEach-Object { $_.Trim() } | Where-Object {
$_ -ne "" }
if
($patterns.Count -eq 0) {
Write-Host "No se han introducido cadenas. Saliendo..."
-ForegroundColor Red
exit
}
Write-Host "`nCadenas a
buscar:" -ForegroundColor Yellow
$patterns | ForEach-Object {
Write-Host " - $_" -ForegroundColor Green }
# Convertir a regex OR
$regex = ($patterns -join
"|")
$results = New-Object
System.Collections.Generic.List[object]
function
Add-Result($Tipo,$Ruta,$Detalle) {
$results.Add([pscustomobject]@{
Tipo = $Tipo
Ruta = $Ruta
Detalle = $Detalle
})
}
#
=====================================================================
# [0]
PROGRAMAS INSTALADOS (Add/Remove Programs)
#
=====================================================================
Write-Host "`n========== [0]
PROGRAMAS INSTALADOS ==========" -ForegroundColor Cyan
$installedApps = Get-ItemProperty
HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, `
HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, `
HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* `
-ErrorAction SilentlyContinue
foreach ($app in $installedApps) {
if
($app.DisplayName -match $regex) {
Add-Result "Programa Instalado" $app.DisplayName
$app.DisplayVersion
Write-Host "Programa detectado: $($app.DisplayName)"
-ForegroundColor Green
}
}
#
=====================================================================
# [1] PROCESOS
#
=====================================================================
Write-Host "`n========== [1]
PROCESOS ==========" -ForegroundColor Cyan
Get-Process -ErrorAction
SilentlyContinue |
Where-Object {
$_.Name -match $regex } |
ForEach-Object
{
Add-Result "Proceso" ($_.Path) ($_.Name)
$_
}
#
=====================================================================
# [2] SERVICIOS
#
=====================================================================
Write-Host "`n========== [2]
SERVICIOS ==========" -ForegroundColor Cyan
Get-Service -ErrorAction
SilentlyContinue |
Where-Object {
$_.Name -match $regex -or $_.DisplayName -match $regex } |
ForEach-Object
{
Add-Result "Servicio" $_.Name $_.DisplayName
$_
}
#
=====================================================================
# [3] TAREAS PROGRAMADAS
#
=====================================================================
Write-Host "`n========== [3]
TAREAS PROGRAMADAS ==========" -ForegroundColor Cyan
Get-ScheduledTask -ErrorAction
SilentlyContinue |
Where-Object {
$_.TaskName -match $regex -or $_.Description -match $regex } |
ForEach-Object
{
Add-Result "Tarea Programada" $_.TaskName $_.Description
$_
}
#
=====================================================================
# [4]
CARPETAS HABITUALES
#
=====================================================================
Write-Host
"`n========== [4] CARPETAS HABITUALES ==========" -ForegroundColor
Cyan
$paths = @(
"$env:LOCALAPPDATA",
"$env:LOCALAPPDATA\Programs",
"$env:APPDATA",
"$env:TEMP",
"$env:ProgramFiles",
"$env:ProgramFiles(x86)"
)
foreach ($base in $paths) {
if (Test-Path
$base) {
Get-ChildItem $base -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match $regex } |
ForEach-Object {
Add-Result "Archivo/Carpeta" $_.FullName "Coincidencia en
nombre"
Write-Host "Encontrado:
$($_.FullName)" -ForegroundColor Green
}
}
}
#
=====================================================================
# [5] RUN / RUNONCE
#
=====================================================================
Write-Host "`n========== [5]
RUN / RUNONCE ==========" -ForegroundColor Cyan
$runKeys = @(
"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
"HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($rk in $runKeys) {
if (Test-Path
$rk) {
$vals = Get-ItemProperty $rk -ErrorAction SilentlyContinue
foreach ($prop in $vals.PSObject.Properties) {
if ($prop.Name -notlike "PS*" -and (
$prop.Name -match $regex -or ($prop.Value -as [string]) -match $regex
)) {
Add-Result "RunKey" $rk "$($prop.Name) = $($prop.Value)"
Write-Host "[RUN] $rk → $($prop.Name) = $($prop.Value)"
-ForegroundColor Green
}
}
}
}
#
=====================================================================
# [6]
SERVICIOS DEL REGISTRO
#
=====================================================================
Write-Host
"`n========== [6] SERVICIOS DEL REGISTRO =========="
-ForegroundColor Cyan
Get-ChildItem
"HKLM:\SYSTEM\CurrentControlSet\Services" -ErrorAction
SilentlyContinue |
Where-Object {
$_.Name -match $regex } |
ForEach-Object
{
Add-Result "RegistroServicio" $_.Name "Coincidencia en nombre
de clave"
$_.Name
}
#
=====================================================================
# [7] INICIO DE WINDOWS (Startup)
#
=====================================================================
Write-Host
"`n========== [7] PROGRAMAS EN EL INICIO =========="
-ForegroundColor Cyan
$startupPaths = @(
"$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
"$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
)
foreach ($sp in $startupPaths) {
if (Test-Path
$sp) {
Get-ChildItem $sp -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match $regex } |
ForEach-Object {
Add-Result "Inicio Windows" $_.FullName "Coincidencia en
acceso directo"
Write-Host "En inicio: $($_.FullName)" -ForegroundColor Yellow
}
}
}
#
=====================================================================
# [8] BINARIOS EN APPDATA / TEMP
#
=====================================================================
Write-Host "`n========== [8]
BINARIOS APPDATA / TEMP ==========" -ForegroundColor Cyan
$binroots =
@("$env:LOCALAPPDATA","$env:APPDATA","$env:TEMP")
foreach ($br in $binroots) {
if (Test-Path
$br) {
Get-ChildItem $br -Recurse -ErrorAction SilentlyContinue |
Where-Object { $_.Name -match $regex } |
ForEach-Object {
Add-Result "Binario" $_.FullName "Coincidencia en nombre"
Write-Host "Binario
detectado: $($_.FullName)" -ForegroundColor Green
}
}
}
#
=====================================================================
# RESUMEN + EXPORTACIÓN
#
=====================================================================
Write-Host
"`n==============================================" -ForegroundColor
Cyan
Write-Host
"
RESUMEN" -ForegroundColor Cyan
Write-Host
"==============================================" -ForegroundColor
Cyan
$results |
Format-Table -AutoSize
# Nombre con
fecha y hora
$timestamp =
(Get-Date).ToString("yyyy-MM-dd_HH-mm-ss")
$output =
"C:\Temp\Deteccion-Resultado_$timestamp.csv"
New-Item -ItemType Directory -Path
(Split-Path $output) -Force | Out-Null
$results | Export-Csv -Path
$output -NoTypeInformation -Encoding UTF8
Write-Host "`nArchivo
exportado: $output" -ForegroundColor Yellow
Write-Host
"`n--- ANÁLISIS FINALIZADO ---" -ForegroundColor Cyan
|
%20-%20Word.jpg)
%20-%20Word.jpg)
%20-%20Word.jpg)
%20-%20Word.jpg)
%20-%20Word.jpg)
%20-%20Word.jpg)
%20-%20Word.jpg)
%20-%20Word.jpg)
