diff --git a/Scripts/Analyze-HuntSMBShares.ps1 b/Scripts/Analyze-HuntSMBShares.ps1 index 41ee5dc..8e8350c 100644 --- a/Scripts/Analyze-HuntSMBShares.ps1 +++ b/Scripts/Analyze-HuntSMBShares.ps1 @@ -5,7 +5,7 @@ #-------------------------------------- # Author: Scott Sutherland, 2024 NetSPI # License: 3-clause BSD -# Version: v1.81 +# Version: v1.82 # References: This script includes custom code and code taken and modified from the open source projects PowerView, Invoke-Ping, and Invoke-Parrell. function Analyze-HuntSMBShares { @@ -1966,7 +1966,47 @@ function Analyze-HuntSMBShares if($RiskLevelFileListGroupResult -eq "High" ){$RiskLevelFolderGroupCountHigh = $RiskLevelFolderGroupCountHigh + 1} if($RiskLevelFileListGroupResult -eq "Critical"){$RiskLevelFolderGroupCountCritical = $RiskLevelFolderGroupCountCritical + 1} } - + + + # ---------------------------------------------------------------------- + # Calculate Peer Comparison Data - INSIGHTS + # ---------------------------------------------------------------------- + # % of computers, shares, aces with excessive privs enumerated from single active directory domain + + # Set averages from a sample of 50 representative (size and industry) environments + $PeerCompareAverageP = "[18, 9, 15]" + + # Get actual computer % + if($ComputerPingableCount -gt 0){ + $PeerComparisonComputerCount = $ComputerPingableCount # use ping count + }else{ + $PeerComparisonComputerCount = $Computers445OpenCount # use open445 count + } + $PeerComparActualComputers = [math]::Round($ComputerWithExcessive/$PeerComparisonComputerCount,2) * 100 + + # Get actual shares % + $PeerComparActualShares = [math]::Round($ExcessiveSharesCount/$AllSMBSharesCount,2) * 100 + + # Get actual aces % + $PeerComparActualAces = [math]::Round($ExcessiveSharePrivsCount/$ShareACLsCount ,2) * 100 + + # Set actual + $PeerCompareActuaP = "[$PeerComparActualComputers, $PeerComparActualShares, $PeerComparActualAces]" + + # ---------------------------------------------------------------------- + # Calculate Remediation Prioritization and Charts - INSIGHTS + # ---------------------------------------------------------------------- + $RemediationBase = "[$ExcessiveSharePrivsCount,$ExcessiveSharePrivsCount,$ExcessiveSharePrivsCount]" + $RemediationSave = "[$ExcessiveSharePrivsCount,$FolderGroupChartCount,$ShareNameChartCount]" + $RemediationSaveFgP = 100 - ([math]::Round($FolderGroupChartCount/$ExcessiveSharePrivsCount,2) * 100) + $RemediationSaveSnP = 100 - ([math]::Round($ShareNameChartCount/$ExcessiveSharePrivsCount,2) * 100) + + if($RemediationSaveFgP -gt $RemediationSaveSnP){ + $RemediationSavings = $RemediationSaveFgP + }else{ + $RemediationSavings = $RemediationSaveSnP + } + # ---------------------------------------------------------------------- # Create ShareGraph Nodes and Edges # ---------------------------------------------------------------------- @@ -5173,13 +5213,32 @@ input[type="checkbox"]:checked::before {
+ +