WinNetSentry.ps1

[CmdletBinding()]
param(
    [switch]$VerboseOutput = $false,
    [switch]$SkipMenu = $false
)

if ($VerboseOutput) {
    $VerbosePreference = "Continue"
}

# Ensure script is running with Administrative Privileges
$isAdmin = ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)
if (-not $isAdmin) {
    Write-Host "[*] WinNetSentry requires Administrative privileges. Elevating..." -ForegroundColor Cyan
    try {
        Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs
    }
    catch {
        Write-Error "Failed to elevate privileges. Please run PowerShell as Administrator."
    }
    Exit
}

# --- Aesthetic & UI Helpers ---
function Show-Banner {
    Clear-Host
    Write-Host @"
 ██╗    ██╗██╗███╗   ██╗███╗   ██╗███████╗████████╗███████╗███████╗███╗   ██╗████████╗██████╗ ██╗   ██╗
 ██║    ██║██║████╗  ██║████╗  ██║██╔════╝╚══██╔══╝██╔════╝██╔════╝████╗  ██║╚══██╔══╝██╔══██╗╚██╗ ██╔╝
 ██║ █╗ ██║██║██╔██╗ ██║██╔██╗ ██║█████╗     ██║   ███████╗█████╗  ██╔██╗ ██║   ██║   ██████╔╝ ╚████╔╝ 
 ██║███╗██║██║██║╚██╗██║██║╚██╗██║██╔══╝     ██║   ╚════██║██╔══╝  ██║╚██╗██║   ██║   ██╔══██╗  ╚██╔╝  
 ╚███╔███╔╝██║██║ ╚████║██║ ╚████║███████╗   ██║   ███████║███████╗██║ ╚████║   ██║   ██║  ██║   ██║   
  ╚══╝╚══╝ ╚═╝╚═╝  ╚═══╝╚═╝  ╚═══╝╚══════╝   ╚═╝   ╚══════╝╚══════╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝   ╚═╝   
                                                                                                    
                  -- [ Windows 11 Network Audit, DoH Securing & MAC Spoofing Tool ] --
                  -- [           Developed for Privacy, Security & Hardening        ] --
"@ -ForegroundColor Cyan
    Write-Host ("=" * 100) -ForegroundColor DarkGray
}

function Show-Header ([string]$title) {
    Write-Host "`n[>>>] $title" -ForegroundColor Magenta
    Write-Host ("-" * 60) -ForegroundColor DarkMagenta
}

function Pause-Console {
    Write-Host "`nPress any key to return to the main menu..." -ForegroundColor Yellow
    $null = $Host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown")
}

# --- CORE FUNCTION 1: Network Listener & Connection Auditor ---
function Audit-NetworkPorts {
    Show-Header "ACTIVE NETWORK LISTENERS & CONNECTIONS"
    Write-Verbose "[+] Enumerating active TCP and UDP connections..."

    # Retrieve all connections
    $tcpConnections = Get-NetTCPConnection -ErrorAction SilentlyContinue
    $udpConnections = Get-NetUDPEndpoint -ErrorAction SilentlyContinue

    $results = @()

    # Process TCP Connections
    foreach ($conn in $tcpConnections) {
        $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        $procPath = ""
        $procName = "Unknown"
        if ($proc) {
            $procPath = $proc.Path
            $procName = $proc.ProcessName
        }
        
        $results += [PSCustomObject]@{
            Protocol   = "TCP"
            LocalIP    = $conn.LocalAddress
            LocalPort  = $conn.LocalPort
            RemoteIP   = $conn.RemoteAddress
            RemotePort = $conn.RemotePort
            State      = $conn.State
            PID        = $conn.OwningProcess
            Process    = $procName
            Path       = $procPath
        }
    }

    # Process UDP Connections
    foreach ($conn in $udpConnections) {
        $proc = Get-Process -Id $conn.OwningProcess -ErrorAction SilentlyContinue
        $procPath = ""
        $procName = "Unknown"
        if ($proc) {
            $procPath = $proc.Path
            $procName = $proc.ProcessName
        }
        
        $results += [PSCustomObject]@{
            Protocol   = "UDP"
            LocalIP    = $conn.LocalAddress
            LocalPort  = $conn.LocalPort
            RemoteIP   = "N/A"
            RemotePort = "N/A"
            State      = "Listening"
            PID        = $conn.OwningProcess
            Process    = $procName
            Path       = $procPath
        }
    }

    # Display Listeners
    $listeners = $results | Where-Object { $_.State -eq "Listen" -or $_.State -eq "Listening" -or $_.LocalIP -eq "0.0.0.0" -or $_.LocalIP -eq "::" }
    Write-Host "`n[!] ACTIVE LISTENERS (PORTS OPEN TO CONNECTION):" -ForegroundColor Cyan
    if ($listeners.Count -eq 0) {
        Write-Host "No active open listeners detected." -ForegroundColor Green
    } else {
        $listeners | Format-Table Protocol, LocalIP, LocalPort, Process, PID, Path -AutoSize | Out-Host
    }

    # Display Active Outbound/Established Connections
    $activeConns = $results | Where-Object { $_.State -eq "Established" }
    Write-Host "[!] ESTABLISHED NETWORK CONNECTIONS:" -ForegroundColor Cyan
    if ($activeConns.Count -eq 0) {
        Write-Host "No established outbound connections." -ForegroundColor Gray
    } else {
        $activeConns | Format-Table Protocol, LocalIP, LocalPort, RemoteIP, RemotePort, Process, PID -AutoSize | Out-Host
    }

    return $results
}

# --- CORE FUNCTION 2: Hunt for Irregular / Sketchy Processes ---
function Hunt-SketchyProcesses {
    Show-Header "SUSPICIOUS PROCESS & ANOMALY DETECTOR"
    Write-Verbose "[+] Running heuristics to identify sketchy processes..."

    $processes = Get-Process -ErrorAction SilentlyContinue
    $flagged = @()

    # Legitimate system paths
    $system32 = "$env:windir\system32"
    $syswow64 = "$env:windir\syswow64"
    
    # Common system processes that are frequently spoofed
    $coreSystemProcesses = @("svchost", "lsass", "explorer", "cmd", "powershell", "services", "wininit", "winlogon", "spoolsv", "csrss", "smss")

    foreach ($proc in $processes) {
        $path = $proc.Path
        $name = $proc.ProcessName
        $procId = $proc.Id

        if ([string]::IsNullOrEmpty($path)) {
            continue
        }

        $sketchyReasons = @()

        # 1. Check for system binaries running from non-standard locations (Mimicry Check)
        if ($coreSystemProcesses -contains $name.ToLower()) {
            if ($path -notlike "*$system32*" -and $path -notlike "*$syswow64*" -and $name -ne "explorer") {
                $sketchyReasons += "System binary executing from anomalous path: $path"
            }
            if ($name -eq "explorer" -and $path -notlike "*$env:windir\explorer.exe*") {
                $sketchyReasons += "Explorer executing from anomalous path: $path"
            }
        }

        # 2. Check for processes running from highly volatile paths (Temp, AppData, Public, ProgramData)
        if ($path -like "*\AppData\Local\Temp*" -or 
            $path -like "*\Windows\Temp*" -or 
            $path -like "*\Users\Public*" -or 
            $path -like "*\ProgramData\*") {
            $sketchyReasons += "Binary executing from dynamic/temp path: $path"
        }

        # 3. Check signature status of network-listening processes (Authenticode Check)
        $isListener = $false
        $netConns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $_.OwningProcess -eq $procId }
        if ($netConns) {
            $sig = Get-AuthenticodeSignature -FilePath $path -ErrorAction SilentlyContinue
            if ($sig -and $sig.Status -ne "Valid") {
                $sketchyReasons += "Active network listener has an Unsigned/Invalid signature: $($sig.Status)"
            }
        }

        if ($sketchyReasons.Count -gt 0) {
            $flagged += [PSCustomObject]@{
                PID     = $procId
                Process = $name
                Path    = $path
                Reasons = ($sketchyReasons -join " | ")
            }
        }
    }

    if ($flagged.Count -eq 0) {
        Write-Host "[+] Security Audit Complete: No highly anomalous or irregular processes detected." -ForegroundColor Green
    } else {
        Write-Host "[!] ATTENTION: Suspicious or irregular processes identified!" -ForegroundColor Red
        Write-Host "Review the findings below carefully to verify legitimacy:" -ForegroundColor LightRed
        Write-Host ("-" * 100) -ForegroundColor DarkRed
        $flagged | Format-Table PID, Process, Reasons -Wrap -AutoSize | Out-Host
    }

    return $flagged
}

# --- CORE FUNCTION 3: DNS Leak & Encryption (Cloudflare DoH) Auditor ---
function Get-DNSStatus {
    Show-Header "DNS SECURITY & ENCRYPTION STATUS"
    Write-Verbose "[+] Evaluating current DNS Server assignments..."

    $adapters = @(Get-NetAdapter | Where-Object { $_.Status -eq "Up" })
    $dnsSecure = $true
    $report = @()

    # Check DoH policy in registry
    $dohPolicyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient"
    $dohPolicyVal = $null
    if (Test-Path $dohPolicyPath) {
        $dohPolicyVal = (Get-ItemProperty -Path $dohPolicyPath -Name "DoHPolicy" -ErrorAction SilentlyContinue).DoHPolicy
    }

    Write-Host "SYSTEM-WIDE DNS-OVER-HTTPS POLICY:" -ForegroundColor Cyan
    if ($dohPolicyVal -eq 2) {
        Write-Host "  [SECURE] DoH Policy: Enforced / Require DoH (Encrypted Only)" -ForegroundColor Green
    } elseif ($dohPolicyVal -eq 1) {
        Write-Host "  [MODERATE] DoH Policy: Enabled / Preferred DoH (Encrypted Preferred)" -ForegroundColor Yellow
    } else {
        Write-Host "  [VULNERABLE] DoH Policy: Disabled or Not Enforced (Plaintext Fallback Enabled)" -ForegroundColor Red
        $dnsSecure = $false
    }

    Write-Host "`nADAPTER CONFIGURATION:" -ForegroundColor Cyan
    foreach ($adapter in $adapters) {
        $dnsServers = Get-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -AddressFamily IPv4, IPv6 -ErrorAction SilentlyContinue
        
        $v4Servers = $dnsServers | Where-Object { $_.AddressFamily -eq 2 }
        $v6Servers = $dnsServers | Where-Object { $_.AddressFamily -eq 23 }

        $v4Addresses = ""
        if ($v4Servers) { $v4Addresses = $v4Servers.ServerAddresses -join ", " }
        $v6Addresses = ""
        if ($v6Servers) { $v6Addresses = $v6Servers.ServerAddresses -join ", " }

        # Heuristic for secure Cloudflare settings
        $isCloudflareV4 = ($v4Addresses -like "*1.1.1.1*" -or $v4Addresses -like "*1.0.0.1*")
        $isCloudflareV6 = ($v6Addresses -like "*2606:4700:4700::1111*" -or $v6Addresses -like "*2606:4700:4700::1001*")

        $statusColor = "Green"
        $statusText = "Secure (Cloudflare Assigned)"

        if (-not $isCloudflareV4) {
            $statusColor = "Red"
            $statusText = "Vulnerable (Not using Cloudflare secure DNS / Potential Leak)"
            $dnsSecure = $false
        }

        Write-Host "  Adapter: $($adapter.Name)" -ForegroundColor Cyan
        Write-Host "    - Description: $($adapter.InterfaceDescription)" -ForegroundColor Gray
        Write-Host "    - IPv4 DNS   : $v4Addresses" -ForegroundColor Gray
        Write-Host "    - IPv6 DNS   : $v6Addresses" -ForegroundColor Gray
        Write-Host "    - Status     : $statusText" -ForegroundColor $statusColor

        $report += [PSCustomObject]@{
            Adapter     = $adapter.Name
            IPv4DNS     = $v4Addresses
            IPv6DNS     = $v6Addresses
            IsEncrypted = ($dohPolicyVal -ge 1 -and $isCloudflareV4)
            Security    = $statusText
        }
    }

    if ($dnsSecure) {
        Write-Host "`n[+] Success: All active interfaces are secured with Cloudflare DNS. No DNS leaks detected." -ForegroundColor Green
    } else {
        Write-Host "`n[!] Warning: DNS configuration is vulnerable to eavesdropping and leaks." -ForegroundColor Red
        Write-Host "    Select Option [4] from the main menu to apply Cloudflare DNS-over-HTTPS (DoH) protection." -ForegroundColor Yellow
    }

    return [PSCustomObject]@{
        Secure = $dnsSecure
        Policy = $dohPolicyVal
        Report = $report
    }
}

# --- CORE FUNCTION 4: Enforce Cloudflare Secure DNS over HTTPS (DoH) ---
function Set-SecureDNSCloudflare {
    Show-Header "ENFORCING CLOUDFLARE DNS-OVER-HTTPS"
    Write-Verbose "[+] Registering Cloudflare DoH server templates..."

    # 1. Register/Verify Cloudflare DoH templates globally in Windows 11
    $cfServers = @(
        @{ IP = "1.1.1.1"; Template = "https://cloudflare-dns.com/dns-query" },
        @{ IP = "1.0.0.1"; Template = "https://cloudflare-dns.com/dns-query" },
        @{ IP = "2606:4700:4700::1111"; Template = "https://cloudflare-dns.com/dns-query" },
        @{ IP = "2606:4700:4700::1001"; Template = "https://cloudflare-dns.com/dns-query" }
    )

    foreach ($server in $cfServers) {
        $existing = Get-DnsClientDohServerAddress -ServerAddress $server.IP -ErrorAction SilentlyContinue
        if (-not $existing) {
            Write-Verbose "Adding DoH server address entry for $($server.IP)..."
            Add-DnsClientDohServerAddress -ServerAddress $server.IP -DohTemplate $server.Template -AllowFallbackToUdp $false -AutoUpgrade $true -ErrorAction SilentlyContinue
        } else {
            Write-Verbose "DoH entry already configured for $($server.IP). Enforcing full upgrade..."
            Set-DnsClientDohServerAddress -ServerAddress $server.IP -DohTemplate $server.Template -AllowFallbackToUdp $false -AutoUpgrade $true -ErrorAction SilentlyContinue
        }
    }

    # 2. Apply DNS servers to all active network adapters
    $adapters = @(Get-NetAdapter | Where-Object { $_.Status -eq "Up" })
    foreach ($adapter in $adapters) {
        Write-Host "[*] Configuring $($adapter.Name) to use secure Cloudflare DNS..." -ForegroundColor Cyan
        
        # Configure IPv4
        Set-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ServerAddresses ("1.1.1.1", "1.0.0.1") -ErrorAction SilentlyContinue
        
        # Configure IPv6
        Set-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex -ServerAddresses ("2606:4700:4700::1111", "2606:4700:4700::1001") -AddressFamily IPv6 -ErrorAction SilentlyContinue
    }

    # 3. Enforce DoH Policy via the system registry (Encrypted Only)
    Write-Host "[*] Enforcing global DNS-over-HTTPS Policy in registry (Require DoH)..." -ForegroundColor Cyan
    $policyPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient"
    if (-not (Test-Path $policyPath)) {
        $null = New-Item -Path $policyPath -Force -ErrorAction SilentlyContinue
    }
    
    # DoHPolicy: 2 = Require DoH (Encrypted Only / Prevents plain fallback)
    $null = New-ItemProperty -Path $policyPath -Name "DoHPolicy" -Value 2 -PropertyType DWORD -Force -ErrorAction SilentlyContinue

    Write-Host "[+] Cloudflare DNS-over-HTTPS configuration applied successfully!" -ForegroundColor Green
    Write-Host "[+] All DNS queries are now fully encrypted. Unencrypted leaks are mitigated." -ForegroundColor Green
}

# --- CORE FUNCTION 5: Generate Locally Administered Random MAC Address ---
function Generate-RandomMac {
    $chars = "0123456789ABCDEF"
    
    # Standard rule: To make the address a valid Locally Administered Address (LAA),
    # the second hexadecimal character of the MAC address MUST be 2, 6, A, or E.
    $secondChar = "26AE"[(Get-Random -Maximum 4)]
    $firstByte = "$($chars[(Get-Random -Maximum 16)])$secondChar"
    
    $mac = $firstByte
    for ($i = 0; $i -lt 5; $i++) {
        $mac += "$($chars[(Get-Random -Maximum 16)])$($chars[(Get-Random -Maximum 16)])"
    }
    
    return $mac
}

# --- CORE FUNCTION 6: Change MAC Address of Network Interface ---
function Change-MACAddress {
    Show-Header "SPOOF NETWORK ADAPTER MAC ADDRESS"
    
    # 1. Enumerate physical network adapters
    $adapters = @(Get-NetAdapter -Physical | Select-Object Name, InterfaceDescription, Status, MacAddress, InterfaceGuid)
    if ($adapters.Count -eq 0) {
        Write-Host "[-] No physical network adapters found." -ForegroundColor Red
        return
    }

    Write-Host "Select an adapter to spoof:" -ForegroundColor Cyan
    for ($i = 0; $i -lt $adapters.Count; $i++) {
        Write-Host "  [$i] $($adapters[$i].Name) ($($adapters[$i].InterfaceDescription))" -ForegroundColor Gray
        Write-Host "      Current MAC: $($adapters[$i].MacAddress)" -ForegroundColor DarkGray
    }

    $choice = -1
    while ($choice -lt 0 -or $choice -ge $adapters.Count) {
        $inputVal = Read-Host "`nEnter selection [0-$($adapters.Count - 1)]"
        if ([int]::TryParse($inputVal, [ref]$choice)) {
            if ($choice -lt 0 -or $choice -ge $adapters.Count) {
                Write-Host "Invalid choice." -ForegroundColor Red
            }
        } else {
            Write-Host "Please enter a valid integer." -ForegroundColor Red
        }
    }

    $targetAdapter = $adapters[$choice]
    $newMac = ""

    Write-Host "`nChoose MAC Spoofing mode:" -ForegroundColor Cyan
    Write-Host "  [1] Generate Random locally administered MAC (Recommended)" -ForegroundColor Gray
    Write-Host "  [2] Input custom MAC address manually" -ForegroundColor Gray
    
    $macMode = Read-Host "`nSelect mode"
    if ($macMode -eq "2") {
        $validMac = $false
        while (-not $validMac) {
            $customMacInput = Read-Host "Enter custom 12-digit hex MAC (e.g., 02A1C3D4E5F6)"
            $customMac = ($customMacInput -replace '[:-]', '').ToUpper()
            if ($customMac -match '^[0-9A-F]{12}$') {
                $secondChar = $customMac.Substring(1, 1)
                if ("26AE" -notlike "*$secondChar*") {
                    Write-Host "[!] Warning: The second character must be 2, 6, A, or E for Windows adapters to support it." -ForegroundColor Yellow
                    $confirmLAA = Read-Host "Proceed anyway? (y/n)"
                    if ($confirmLAA -eq "y") {
                        $newMac = $customMac
                        $validMac = $true
                    }
                } else {
                    $newMac = $customMac
                    $validMac = $true
                }
            } else {
                Write-Host "[-] Invalid MAC format. Enter exactly 12 hex digits." -ForegroundColor Red
            }
        }
    } else {
        $newMac = Generate-RandomMac
        Write-Host "[+] Generated Random MAC: $newMac" -ForegroundColor Green
    }

    $regMac = ($newMac -replace '[:-]', '').ToUpper()

    Write-Host "`n[*] Locating adapter in the registry..." -ForegroundColor Cyan
    $classPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}"
    $subKeys = Get-ChildItem -Path $classPath -ErrorAction SilentlyContinue
    $foundRegPath = $null

    foreach ($subKey in $subKeys) {
        $val = Get-ItemProperty -Path $subKey.PSPath -ErrorAction SilentlyContinue
        if ($val -and $val.NetCfgInstanceId -eq $targetAdapter.InterfaceGuid) {
            $foundRegPath = $subKey.PSPath
            break
        }
    }

    if ($null -eq $foundRegPath) {
        Write-Host "[-] Error: Could not locate adapter in the registry keys." -ForegroundColor Red
        return
    }

    Write-Verbose "Writing new MAC to registry: $foundRegPath"
    $null = New-ItemProperty -Path $foundRegPath -Name "NetworkAddress" -Value $regMac -PropertyType String -Force -ErrorAction SilentlyContinue

    Write-Host "[*] Cycling adapter $($targetAdapter.Name) to apply spoofed MAC..." -ForegroundColor Cyan
    Disable-NetAdapter -Name $targetAdapter.Name -Confirm:$false -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 2
    Enable-NetAdapter -Name $targetAdapter.Name -Confirm:$false -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 3

    # Verification
    $updatedAdapter = Get-NetAdapter -Name $targetAdapter.Name -ErrorAction SilentlyContinue
    Write-Host "`n[+] Adapter successfully cycled!" -ForegroundColor Green
    Write-Host "    - Expected MAC: $(($regMac -replace '..(?!$)', '$0-'))" -ForegroundColor Gray
    Write-Host "    - Active MAC  : $($updatedAdapter.MacAddress)" -ForegroundColor Cyan

    if ($updatedAdapter.MacAddress -eq ($regMac -replace '..(?!$)', '$0-')) {
        Write-Host "[+] MAC Address Spoof Verified Successfully!" -ForegroundColor Green
    } else {
        Write-Host "[!] Note: If the MAC address did not update, it might be due to adapter-driver restrictions." -ForegroundColor Yellow
        Write-Host "    Ensure you are using a standard LAA-compliant address (second character = 2, 6, A, or E)." -ForegroundColor Yellow
    }
}

# --- CORE FUNCTION 7: Restore Network Adapter Original MAC ---
function Restore-MACAddress {
    Show-Header "RESTORE ORIGINAL ADAPTER MAC ADDRESS"
    
    # 1. Enumerate physical adapters
    $adapters = @(Get-NetAdapter -Physical | Select-Object Name, InterfaceDescription, Status, MacAddress, InterfaceGuid)
    if ($adapters.Count -eq 0) {
        Write-Host "[-] No physical network adapters found." -ForegroundColor Red
        return
    }

    Write-Host "Select an adapter to restore to original MAC:" -ForegroundColor Cyan
    for ($i = 0; $i -lt $adapters.Count; $i++) {
        Write-Host "  [$i] $($adapters[$i].Name) ($($adapters[$i].InterfaceDescription))" -ForegroundColor Gray
        Write-Host "      Active MAC  : $($adapters[$i].MacAddress)" -ForegroundColor DarkGray
    }

    $choice = -1
    while ($choice -lt 0 -or $choice -ge $adapters.Count) {
        $inputVal = Read-Host "`nEnter selection [0-$($adapters.Count - 1)]"
        if ([int]::TryParse($inputVal, [ref]$choice)) {
            if ($choice -lt 0 -or $choice -ge $adapters.Count) {
                Write-Host "Invalid choice." -ForegroundColor Red
            }
        } else {
            Write-Host "Please enter a valid integer." -ForegroundColor Red
        }
    }

    $targetAdapter = $adapters[$choice]

    Write-Host "`n[*] Locating adapter in registry..." -ForegroundColor Cyan
    $classPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Class\{4d36e972-e325-11ce-bfc1-08002be10318}"
    $subKeys = Get-ChildItem -Path $classPath -ErrorAction SilentlyContinue
    $foundRegPath = $null

    foreach ($subKey in $subKeys) {
        $val = Get-ItemProperty -Path $subKey.PSPath -ErrorAction SilentlyContinue
        if ($val -and $val.NetCfgInstanceId -eq $targetAdapter.InterfaceGuid) {
            $foundRegPath = $subKey.PSPath
            break
        }
    }

    if ($null -eq $foundRegPath) {
        Write-Host "[-] Error: Could not locate adapter in the registry keys." -ForegroundColor Red
        return
    }

    Write-Verbose "Removing spoofed NetworkAddress registry value..."
    Remove-ItemProperty -Path $foundRegPath -Name "NetworkAddress" -ErrorAction SilentlyContinue

    Write-Host "[*] Cycling adapter $($targetAdapter.Name) to restore original MAC..." -ForegroundColor Cyan
    Disable-NetAdapter -Name $targetAdapter.Name -Confirm:$false -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 2
    Enable-NetAdapter -Name $targetAdapter.Name -Confirm:$false -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 3

    $updatedAdapter = Get-NetAdapter -Name $targetAdapter.Name -ErrorAction SilentlyContinue
    Write-Host "`n[+] Adapter successfully cycled! Original MAC restored." -ForegroundColor Green
    Write-Host "    - Restored MAC: $($updatedAdapter.MacAddress)" -ForegroundColor Cyan
}

# --- CORE FUNCTION 8: Save Security Audit Logs (MD & JSON) ---
function Save-SecurityReport {
    param(
        $listenersReport,
        $sketchyReport,
        $dnsReport
    )

    Show-Header "GENERATING SECURITY AUDIT REPORTS"

    # Setup report paths under C:\Users\Administrator\Documents\WinNetSentry\logs
    $reportDir = "C:\Users\Administrator\Documents\WinNetSentry\logs"
    if (-not (Test-Path $reportDir)) {
        $null = New-Item -Path $reportDir -ItemType Directory -Force
    }

    $timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
    $jsonPath = "$reportDir\audit_report_$timestamp.json"
    $mdPath = "$reportDir\audit_report_$timestamp.md"

    # 1. Structure JSON Data
    $jsonData = [Ordered]@{
        Timestamp        = (Get-Date -Format "o")
        DNS_Secure       = $dnsReport.Secure
        DNS_Policy       = $dnsReport.Policy
        ActiveListeners  = $listenersReport
        SketchyProcesses = $sketchyReport
        DNS_Config       = $dnsReport.Report
    }

    $jsonData | ConvertTo-Json -Depth 5 | Out-File -FilePath $jsonPath -Encoding utf8
    Write-Host "[+] JSON Log saved to: [logs\$(Split-Path $jsonPath -Leaf)](file:///$jsonPath)" -ForegroundColor Green

    # 2. Build Premium Markdown Report
    $md = "# WinNetSentry Security Audit Report`n"
    $md += "**Generated on**: $(Get-Date -Format 'dddd, MMMM dd, yyyy HH:mm:ss')`n"
    $md += "**System**: $env:COMPUTERNAME`n`n"
    $md += "---`n`n"
    $md += "## DNS Security & DoH Encryption Status`n"
    
    $policyText = "Vulnerable (Plaintext allowed)"
    if ($dnsReport.Policy -eq 2) { $policyText = "Required (DoH Only)" }
    elseif ($dnsReport.Policy -eq 1) { $policyText = "Encrypted Preferred" }
    
    $leakText = "VULNERABLE - Unencrypted plain DNS servers detected"
    if ($dnsReport.Secure) { $leakText = "ACTIVE - All interfaces configured securely with Cloudflare DoH" }

    $md += "- **System DNS-over-HTTPS Policy**: $policyText`n"
    $md += "- **DNS Leak Protection**: $leakText`n`n"
    $md += "### Adapter Details:`n"
    $md += "| Adapter Name | IPv4 DNS Servers | IPv6 DNS Servers | Security Status |`n"
    $md += "| :--- | :--- | :--- | :--- |`n"

    foreach ($item in $dnsReport.Report) {
        $md += "| $($item.Adapter) | $($item.IPv4DNS) | $($item.IPv6DNS) | $($item.Security) |`n"
    }

    $md += "`n---`n`n## Active Listeners & Port Map`n"
    if ($listenersReport.Count -eq 0) {
        $md += "No active port listeners detected.`n"
    } else {
        $md += "| Protocol | Local IP | Port | Process Name | PID | Binary Path |`n"
        $md += "| :--- | :--- | :--- | :--- | :--- | :--- |`n"
        foreach ($conn in $listenersReport) {
            if ($conn.State -eq "Listen" -or $conn.State -eq "Listening" -or $conn.LocalIP -eq "0.0.0.0" -or $conn.LocalIP -eq "::") {
                $md += "| $($conn.Protocol) | $($conn.LocalIP) | $($conn.LocalPort) | $($conn.Process) | $($conn.PID) | $($conn.Path) |`n"
            }
        }
    }

    $md += "`n---`n`n## Suspicious Processes / Sketchy File Anomaly Detections`n"
    if ($sketchyReport.Count -eq 0) {
        $md += "No anomalous/sketchy processes or unsigned active listener files were detected on the system.`n"
    } else {
        $md += "| PID | Process Name | Reasons Flags | Binary Path |`n"
        $md += "| :--- | :--- | :--- | :--- |`n"
        foreach ($proc in $sketchyReport) {
            $md += "| $($proc.PID) | $($proc.Process) | $($proc.Reasons) | $($proc.Path) |`n"
        }
    }

    $md += "`n---`n*WinNetSentry Audits are intended for system administrative analysis and privacy verification purposes.*`n"

    $md | Out-File -FilePath $mdPath -Encoding utf8
    Write-Host "[+] Markdown Audit Report saved to: [logs\$(Split-Path $mdPath -Leaf)](file:///$mdPath)" -ForegroundColor Green
}

# --- MAIN MENU ENGINE ---
if (-not $SkipMenu) {
    $listenersStore = @()
    $sketchyStore = @()
    $dnsStore = $null

    $running = $true
    while ($running) {
        Show-Banner
        Write-Host "  [1] Audit Active Network Listeners" -ForegroundColor Cyan
        Write-Host "  [2] Hunt for Irregular / Sketchy Processes" -ForegroundColor Cyan
        Write-Host "  [3] Audit DNS Leaks & Encryption Status" -ForegroundColor Cyan
        Write-Host "  [4] Enforce Cloudflare DNS-over-HTTPS (Auto-Fix Leaks)" -ForegroundColor Green
        Write-Host "  [5] Spoof Network Adapter MAC Address (Random or Custom)" -ForegroundColor Yellow
        Write-Host "  [6] Restore Adapter Original MAC Address" -ForegroundColor Yellow
        Write-Host "  [7] Generate Unified Security Report (Save Logs)" -ForegroundColor Magenta
        Write-Host "  [8] Exit" -ForegroundColor Red
        Write-Host ("=" * 100) -ForegroundColor DarkGray
        
        $choice = Read-Host "Select an option [1-8]"

        switch ($choice) {
            "1" {
                $listenersStore = Audit-NetworkPorts
                Pause-Console
            }
            "2" {
                $sketchyStore = Hunt-SketchyProcesses
                Pause-Console
            }
            "3" {
                $dnsStore = Get-DNSStatus
                Pause-Console
            }
            "4" {
                Set-SecureDNSCloudflare
                $dnsStore = Get-DNSStatus
                Pause-Console
            }
            "5" {
                Change-MACAddress
                Pause-Console
            }
            "6" {
                Restore-MACAddress
                Pause-Console
            }
            "7" {
                if ($listenersStore.Count -eq 0) {
                    Write-Verbose "[*] Pre-fetching Network Port details..."
                    $listenersStore = Audit-NetworkPorts
                }
                if ($sketchyStore.Count -eq 0) {
                    Write-Verbose "[*] Pre-fetching Sketchy Process hunts..."
                    $sketchyStore = Hunt-SketchyProcesses
                }
                if ($null -eq $dnsStore) {
                    Write-Verbose "[*] Pre-fetching DNS status..."
                    $dnsStore = Get-DNSStatus
                }
                
                Save-SecurityReport -listenersReport $listenersStore -sketchyReport $sketchyStore -dnsReport $dnsStore
                Pause-Console
            }
            "8" {
                Write-Host "`nThank you for using WinNetSentry. Stay Secure!" -ForegroundColor Green
                $running = $false
            }
            default {
                Write-Host "Invalid option. Please choose a number between 1 and 8." -ForegroundColor Red
                Start-Sleep -Seconds 1
            }
        }
    }
}