Tracking Malware Execution Logs Using PowerShell Script

By /

Listen to this Post

 Tracking malware execution logs using PowerShell involves monitoring processes, file changes, network activity, and other system events. Below is a practical PowerShell script to track potential malware activity. This script logs process creation, file modifications, and network connections to a file for analysis.

PowerShell Script: Track Malware Execution Logs

# Define log file path
$logFile = "C:\MalwareTracker\MalwareLogs.txt"

# Create log directory if it doesn't exist
if (-not (Test-Path "C:\MalwareTracker")) {
    New-Item -ItemType Directory -Path "C:\MalwareTracker" | Out-Null
}

# Function to log events
function Log-Event {
    param (
        [string]$message
    )
    $timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $logEntry = "[$timestamp] $message"
    Add-Content -Path $logFile -Value $logEntry
}

# Monitor process creation
Start-Job -Name ProcessMonitor -ScriptBlock {
    Register-WmiEvent -Query "SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'" -SourceIdentifier ProcessCreated
    while ($true) {
        $event = Wait-Event -SourceIdentifier ProcessCreated
        $processName = $event.SourceEventArgs.NewEvent.TargetInstance.Name
        $processID = $event.SourceEventArgs.NewEvent.TargetInstance.ProcessId
        Log-Event "New process created: $processName (PID: $processID)"
        Remove-Event -SourceIdentifier ProcessCreated
    }
}

# Monitor file changes in specific directories (e.g., Downloads, Temp)
Start-Job -Name FileMonitor -ScriptBlock {
    $watcher = New-Object System.IO.FileSystemWatcher
    $watcher.Path = "C:\Users\$env:USERNAME\Downloads"
    $watcher.IncludeSubdirectories = $true
    $watcher.EnableRaisingEvents = $true
    $watcher.NotifyFilter = [System.IO.NotifyFilters]::LastWrite -bor [System.IO.NotifyFilters]::FileName

    Register-ObjectEvent -InputObject $watcher -EventName Changed -SourceIdentifier FileChanged
    Register-ObjectEvent -InputObject $watcher -EventName Created -SourceIdentifier FileCreated

    while ($true) {
        $event = Wait-Event -SourceIdentifier FileChanged, FileCreated
        $eventType = $event.SourceIdentifier
        $filePath = $event.SourceEventArgs.FullPath
        Log-Event "File $eventType: $filePath"
        Remove-Event -SourceIdentifier FileChanged, FileCreated
    }
}

# Monitor network connections
Start-Job -Name NetworkMonitor -ScriptBlock {
    while ($true) {
        $connections = Get-NetTCPConnection | Where-Object { $_.State -eq "Established" }
        foreach ($conn in $connections) {
            $localAddress = $conn.LocalAddress
            $localPort = $conn.LocalPort
            $remoteAddress = $conn.RemoteAddress
            $remotePort = $conn.RemotePort
            Log-Event "Network connection: $localAddress:$localPort -> $remoteAddress:$remotePort"
        }
        Start-Sleep -Seconds 10
    }
}

# Keep the script running
Write-Host "Malware tracking started. Logs are being saved to $logFile"
while ($true) {
    Start-Sleep -Seconds 60
}

How It Works:

  1. Process Monitoring:
  • Uses WMI to detect new processes (Win32_Process creation events).
  • Logs the process name and PID.
  1. File Monitoring:
  • Watches the Downloads folder (or any specified directory) for file changes and creations.
  • Logs the file path and event type (created or modified).
  1. Network Monitoring:
  • Checks active TCP connections every 10 seconds.
  • Logs local and remote IP addresses and ports.
  1. Logging:
  • All events are logged to C:\MalwareTracker\MalwareLogs.txt with timestamps.

How to Use:

  1. Save the script as MalwareTracker.ps1.
  2. Run the script with administrative privileges:
   .\MalwareTracker.ps1
  1. Let it run in the background while you suspect malware activity.
  2. Review the log file (C:\MalwareTracker\MalwareLogs.txt) for suspicious activity.

Example Log Output:

[2023-10-15 14:23:45] New process created: notepad.exe (PID: 1234)
[2023-10-15 14:24:10] File Created: C:\Users\JohnDoe\Downloads\malware.exe
[2023-10-15 14:24:30] Network connection: 192.168.1.100:54321 -> 45.67.89.123:80

Notes:

  • Performance: This script may consume resources if monitoring heavily used directories or systems with many processes/connections.
  • Customization: Adjust the monitored directories ($watcher.Path) or add more event types as needed.
  • Stopping the Script: Press Ctrl+C to stop the script and clean up background jobs.

This script provides a practical way to track malware activity using PowerShell.

References:

Hackers Feeds, Undercode AIFeatured Image

Related Posts: