Initial_Triage_Script

# Ask user to run locally or remotely
$runLocal = Read-Host "Run script locally or remotely? Enter 'local' or 'remote'"

if ($runLocal -eq 'remote') {
    $cred = Get-Credential
    $remoteIP = Read-Host "Enter the IP address of the remote system"
    $targetName = $remoteIP
} else {
    $remoteIP = $env:COMPUTERNAME
    $targetName = $remoteIP
}

$timestamp = Get-Date -Format "yyyyMMdd-HHmmss"
$sanitizedIP = $targetName -replace '[^0-9A-Za-z]', '_'
$localOutputPath = "C:\Users\[User]\Desktop\DiscoverOutput-$sanitizedIP-$timestamp.txt"
$localZipPath = "C:\Users\[User]\Desktop\DiscoverOutput-$sanitizedIP-$timestamp.zip"
$localLogPath = "C:\Users\[User]\Desktop\DiscoverLog-$sanitizedIP-$timestamp.txt"

$log = @()

Write-Host "Select a profile or customize your scan:" -ForegroundColor Cyan
$profiles = @(
    "1. Quick Scan (Processes, Network, Users)",
    "2. Deep Scan (Everything)",
    "3. Custom Scan"
)
$profiles | ForEach-Object { Write-Host $_ }
$profileChoice = Read-Host "Enter profile number"

switch ($profileChoice) {
    '1' { $selection = '4,6,7'; $collectAll = $false }
    '2' { $selection = '11'; $collectAll = $true }
    default {
        Write-Host "Select data to collect:" -ForegroundColor Cyan
        $menu = @("1. System Info","2. Directory Walk","3. Suspicious Executables","4. Network Info","5. Services","6. User Accounts","7. Processes","8. Scheduled Tasks","9. Registry & WMI","10. Event Logs","11. All of the above")
        $menu | ForEach-Object { Write-Host $_ }
        $selection = Read-Host "Enter numbers separated by commas (e.g., 1,3,5 or 11)"
        $collectAll = ($selection -split ',' | ForEach-Object { $_.Trim() }) -contains '11'
    }
}

Try {
    if ($runLocal -eq 'remote') {
        Invoke-Command -ComputerName $remoteIP -Credential $cred -ScriptBlock {
            param($selection, $collectAll)
            $selection = $selection -split ',' | ForEach-Object { $_.Trim() }
            $data = @()
            $data += "====== Triage Script Started: $(Get-Date) ======"

            Function Add-TriageBlock {
                param($condition, $label, $script)
                if ($collectAll -or $selection -contains $condition) {
                    $data += "====== $label ======"
                    Try { $data += (& $script) } Catch { $data += "[Error] $_" }
                }
            }

            Add-TriageBlock 1 "System Info" { systeminfo }
            Add-TriageBlock 2 "Directory Walk" { Get-ChildItem -Path "C:\Users\[User2]" -Recurse | Out-String }
            Add-TriageBlock 3 "Suspicious Executables" {
                Get-ChildItem -Path "C:\Users\[User]" -Recurse |
                    Where-Object { $_.Extension -match '\.(exe|ps1(xml)?|ps2(xml)?|psc1|psc2|py|pif|msi|scr|hta|chm|jar|bat|cmd|vbs?|reg|inf)$' } |
                    Out-String
            }
            Add-TriageBlock 4 "NetStat" { netstat -anob }
            Add-TriageBlock 4 "Network Connections" { Get-NetTCPConnection | Out-String }
            Add-TriageBlock 4 "Net Start" { net start }
            Add-TriageBlock 5 "Services" { Get-Service | Select-Object Name, DisplayName, Status, StartType | Out-String }
            Add-TriageBlock 6 "User Accounts" { Get-LocalUser | Out-String }
            Add-TriageBlock 7 "Running Processes" { Get-Process | Select-Object ProcessName, Id, Path | Out-String }
            Add-TriageBlock 8 "Scheduled Tasks" {
                Get-ScheduledTask | Where-Object { $_.Author -notlike 'Microsoft*' -and $_.Author -notlike '*@%SystemRoot%\\*' } |
                    Select-Object TaskName, TaskPath, Author, Actions, Triggers, Description, State | Out-String
            }
            Add-TriageBlock 8 "Scheduled Jobs" { Get-ScheduledJob | Out-String }
            Add-TriageBlock 9 "Firewall Status" { Get-NetFirewallProfile | Out-String }
            Add-TriageBlock 10 "Event Logs" { Get-WinEvent -LogName Security | Format-List | Out-String }
            Add-TriageBlock 9 "Registry Run Keys (Current User)" {
                Get-ChildItem "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" | Out-String
                Get-ChildItem "HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" | Out-String
            }
            Add-TriageBlock 9 "Registry Run Keys (Local Machine)" {
                Get-ChildItem "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run" | Out-String
                Get-ChildItem "HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce" | Out-String
            }
            Add-TriageBlock 9 "WMI Persistence" {
                Get-WmiObject -Namespace "root\\subscription" -Class "__EventFilter" | Out-String
                Get-WmiObject -Namespace "root\\subscription" -Class "CommandLineEventConsumer" | Out-String
                Get-WmiObject -Namespace "root\\subscription" -Class "FilterToConsumerBinding" | Out-String
            }
            Add-TriageBlock 9 "DNS Cache" { ipconfig /displaydns }
            Add-TriageBlock 9 "Modified Files (7 Days)" {
                Get-ChildItem -Path "C:\Users\*" -Recurse -ErrorAction SilentlyContinue |
                    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
                    Select-Object FullName, LastWriteTime | Out-String
            }
            Add-TriageBlock 9 "Environment Variables" { Get-ChildItem Env: | Out-String }
            Add-TriageBlock 9 "Suspicious Parent-Child Process Pairs" {
                Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -ne 0 } |
                    Select-Object Name, ProcessId, ParentProcessId | Out-String
            }
            Add-TriageBlock 9 "Windows Defender Exclusions" {
                Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess | Out-String
            }

            $data += "====== Triage Script Completed: $(Get-Date) ======"
            return $data
        } -ArgumentList $selection, $collectAll | Out-File -FilePath $localOutputPath -Encoding UTF8
    } else {
        $selection = $selection -split ',' | ForEach-Object { $_.Trim() }
        $data = @()
        $data += "====== Triage Script Started: $(Get-Date) ======"

        Function Add-TriageBlock {
            param($condition, $label, $script)
            if ($collectAll -or $selection -contains $condition) {
                $data += "====== $label ======"
                Try { $data += (& $script) } Catch { $data += "[Error] $_" }
            }
        }

        Add-TriageBlock 1 "System Info" { systeminfo }
        Add-TriageBlock 2 "Directory Walk" { Get-ChildItem -Path "C:\Users\[User2]" -Recurse | Out-String }
        Add-TriageBlock 3 "Suspicious Executables" {
            Get-ChildItem -Path "C:\Users\[User]" -Recurse |
                Where-Object { $_.Extension -match '\.(exe|ps1(xml)?|ps2(xml)?|psc1|psc2|py|pif|msi|scr|hta|chm|jar|bat|cmd|vbs?|reg|inf)$' } |
                Out-String
        }
        Add-TriageBlock 4 "NetStat" { netstat -anob }
        Add-TriageBlock 4 "Network Connections" { Get-NetTCPConnection | Out-String }
        Add-TriageBlock 4 "Net Start" { net start }
        Add-TriageBlock 5 "Services" { Get-Service | Select-Object Name, DisplayName, Status, StartType | Out-String }
        Add-TriageBlock 6 "User Accounts" { Get-LocalUser | Out-String }
        Add-TriageBlock 7 "Running Processes" { Get-Process | Select-Object ProcessName, Id, Path | Out-String }
        Add-TriageBlock 8 "Scheduled Tasks" {
            Get-ScheduledTask | Where-Object { $_.Author -notlike 'Microsoft*' -and $_.Author -notlike '*@%SystemRoot%\\*' } |
                Select-Object TaskName, TaskPath, Author, Actions, Triggers, Description, State | Out-String
        }
        Add-TriageBlock 8 "Scheduled Jobs" { Get-ScheduledJob | Out-String }
        Add-TriageBlock 9 "Firewall Status" { Get-NetFirewallProfile | Out-String }
        Add-TriageBlock 10 "Event Logs" { Get-WinEvent -LogName Security | Format-List | Out-String }
        Add-TriageBlock 9 "Registry Run Keys (Current User)" {
            Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" | Out-String
            Get-ChildItem "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-String
        }
        Add-TriageBlock 9 "Registry Run Keys (Local Machine)" {
            Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run" | Out-String
            Get-ChildItem "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce" | Out-String
        }
        Add-TriageBlock 9 "WMI Persistence" {
            Get-WmiObject -Namespace "root\subscription" -Class "__EventFilter" | Out-String
            Get-WmiObject -Namespace "root\subscription" -Class "CommandLineEventConsumer" | Out-String
            Get-WmiObject -Namespace "root\subscription" -Class "FilterToConsumerBinding" | Out-String
        }
        Add-TriageBlock 9 "DNS Cache" { ipconfig /displaydns }
        Add-TriageBlock 9 "Modified Files (7 Days)" {
            Get-ChildItem -Path "C:\Users\*" -Recurse -ErrorAction SilentlyContinue |
                Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } |
                Select-Object FullName, LastWriteTime | Out-String
        }
        Add-TriageBlock 9 "Environment Variables" { Get-ChildItem Env: | Out-String }
        Add-TriageBlock 9 "Suspicious Parent-Child Process Pairs" {
            Get-CimInstance Win32_Process | Where-Object { $_.ParentProcessId -ne 0 } |
                Select-Object Name, ProcessId, ParentProcessId | Out-String
        }
        Add-TriageBlock 9 "Windows Defender Exclusions" {
            Get-MpPreference | Select-Object ExclusionPath, ExclusionExtension, ExclusionProcess | Out-String
        }

        $data += "====== Triage Script Completed: $(Get-Date) ======"
        $data | Out-File -FilePath $localOutputPath -Encoding UTF8
    }

    Compress-Archive -Path $localOutputPath -DestinationPath $localZipPath -Force
    Remove-Item -Path $localOutputPath -Force

    $log += "[$timestamp] Successfully ran triage on $targetName and saved to $localZipPath"
} Catch {
    $log += "[$timestamp] Failed to run triage on $targetName. Error: $_"
}

$log | Out-File -FilePath $localLogPath -Encoding UTF8 -Append