INTEL-SA-00075 Detection and Mitigation Tool Script

<?xml version="1.0" encoding="utf-8"?>
<ScExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
  <Procedure name="INTEL-SA-00075 Detection and Mitigation Tool Script" treePres="3" id="466121963" folderId="836592424258865" treeFullPath="myProcedures - NetworkDepot.Kyle.Test 2017.Publish">
    <Body description="Script Name: Intel-SA-00075 Detection and Mitigation Tool&#xA;Script Desc: Downloads and installs intel-sa-0075. Then runs the tool to detect of the machine is vulnerable. Can repoty using $intel-sa-00075$ and $intel-vulnerable$ to see only the vulnerable machines. Also uploads a copy of the full report to to GetFile as intel-sa-00075.xml&#xA;&#xA;Date: 12/1/2017&#xA;Company: VirtualAdministrator&#xA;Author: Kyle&#xA;Acknowledgments:&#xA;&#xA;(c) Copyright 2017 Network Depot, LLC (Virtual Administrator) ALL RIGHTS RESERVED.   This script is the property of Network Depot, LLC (dba VirtualAdministrator), and use is restricted to active clients.  Do not re-distribute without written authorization.">
      <Statement name="GetVariable" continueOnFail="false">
        <Parameter xsi:type="EnumParameter" name="VariableType" value="ConstantValue" />
        <Parameter xsi:type="StringParameter" name="SourceContent" value="#vAgentconfiguration.AgentTempDir#\INTEL-SA-00075" />
        <Parameter xsi:type="StringParameter" name="VariableName" value="local" />
      </Statement>
      <Statement name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
        <Parameter xsi:type="StringParameter" name="Command" value="del /q /s #local#" />
        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
      </Statement>
      <Statement name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
        <Parameter xsi:type="StringParameter" name="Command" value="mkdir #local#" />
        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
      </Statement>
      <Statement name="GetURL" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="URL" value="http://files.mymsp.com/downloads/kyle/vbs/regex_single_match_puller.vbs" />
        <Parameter xsi:type="StringParameter" name="ResponseFileName" value="#local#\regex_single_match_puller.vbs" />
        <Parameter xsi:type="BooleanParameter" name="WaitComplete" value="True" />
      </Statement>
      <Statement name="GetURL" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="URL" value="http://files.mymsp.com/downloads/intel/INTEL-SA-00075.zip" />
        <Parameter xsi:type="StringParameter" name="ResponseFileName" value="#local#\INTEL-SA-00075.zip" />
        <Parameter xsi:type="BooleanParameter" name="WaitComplete" value="True" />
      </Statement>
      <Statement name="Unzip file" continueOnFail="false">
        <Parameter xsi:type="StringParameter" name="Parameter1" value="#local#\INTEL-SA-00075.zip" />
        <Parameter xsi:type="StringParameter" name="Parameter2" value="#local#" />
        <Parameter xsi:type="StringParameter" name="Parameter3" value="True" />
      </Statement>
      <If description="">
        <Condition name="Windows 32 or 64 Bit Check">
          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
        </Condition>
        <Then>
          <Statement name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
            <Parameter xsi:type="StringParameter" name="Command" value="msiexec.exe /i &quot;#local#\INTEL-SA-00075 Detection and Mitigation Tool.msi&quot; /qn" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="True" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
            <Parameter xsi:type="StringParameter" name="Command" value="&quot;%PROGRAMFILES(X86)%\Intel\Intel-SA-00075 Detection and Mitigation Tool\Intel-SA-00075-console.exe&quot; -Discover -f -p &quot;#local#&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="True" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="cscript.exe /nologo #local#\regex_single_match_puller.vbs &quot;#local#\#vAgentConfiguration.machName#.xml&quot; &quot;&lt;&lt;System_Risk&gt;&gt;(.*?)&lt;&lt;/System_Risk&gt;&gt;&quot; 0 &gt;&gt; &quot;#local#\pulled.txt&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="True" />
          </Statement>
        </Then>
        <Else>
          <Statement name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
            <Parameter xsi:type="StringParameter" name="Command" value="msiexec.exe /i &quot;#local#\INTEL-SA-00075 Detection and Mitigation Tool.msi&quot; /qn" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
            <Parameter xsi:type="StringParameter" name="Command" value="&quot;%PROGRAMFILES%\Intel\Intel-SA-00075 Detection and Mitigation Tool\Intel-SA-00075-console.exe&quot; -Discover -f -p &quot;#local#&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
          <Statement name="ExecuteShellCommand" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Command" value="cscript.exe /nologo #local#\regex_single_match_puller.vbs &quot;#local#\#vAgentConfiguration.machName#.xml&quot; &quot;&lt;&lt;System_Risk&gt;&gt;(.*?)&lt;&lt;/System_Risk&gt;&gt;&quot; 0 &gt;&gt; &quot;#local#\pulled.txt&quot;" />
            <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
            <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
          </Statement>
        </Else>
      </If>
      <If description="check the output of the tool">
        <Condition name="TestFile">
          <Parameter xsi:type="StringParameter" name="Path" value="#local#\#vAgentConfiguration.machName#.xml" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
          <Parameter xsi:type="StringParameter" name="Value" value="" />
        </Condition>
        <Then>
          <Statement name="GetFile" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="RemoteFileName" value="#local#\#vAgentConfiguration.machName#.xml" />
            <Parameter xsi:type="StringParameter" name="KServerFileName" value="intel-sa-00075-log.xml" />
            <Parameter xsi:type="EnumParameter" name="Action" value="OverwriteNoAlert" />
          </Statement>
        </Then>
      </If>
      <If description="">
        <Condition name="TestFile">
          <Parameter xsi:type="StringParameter" name="Path" value="#local#\pulled.txt" />
          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
          <Parameter xsi:type="StringParameter" name="Value" value="" />
        </Condition>
        <Then>
          <Statement name="GetVariable" continueOnFail="false">
            <Parameter xsi:type="EnumParameter" name="VariableType" value="FileContent" />
            <Parameter xsi:type="StringParameter" name="SourceContent" value="#local#\pulled.txt" />
            <Parameter xsi:type="StringParameter" name="VariableName" value="pulled" />
          </Statement>
          <If description="">
            <Condition name="CheckVariable">
              <Parameter xsi:type="StringParameter" name="VariableName" value="#pulled#" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
              <Parameter xsi:type="StringParameter" name="Value" value="this system is vulnerable" />
            </Condition>
            <Then>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="#pulled# $intel-sa-00075$ $intel-vulnerable$" />
              </Statement>
            </Then>
            <Else>
              <If description="">
                <Condition name="CheckVariable">
                  <Parameter xsi:type="StringParameter" name="VariableName" value="#pulled#" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
                  <Parameter xsi:type="StringParameter" name="Value" value="Check with OEM" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="#pulled# $intel-sa-00075$ $intel-vulnerable$" />
                  </Statement>
                </Then>
                <Else>
                  <If description="">
                    <Condition name="CheckVariable">
                      <Parameter xsi:type="StringParameter" name="VariableName" value="#pulled#" />
                      <Parameter xsi:type="EnumParameter" name="Condition" value="Contains" />
                      <Parameter xsi:type="StringParameter" name="Value" value="this system’s risk is unknown" />
                    </Condition>
                    <Then>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="#pulled# $intel-sa-00075$ $intel-vulnerable$" />
                      </Statement>
                    </Then>
                    <Else>
                      <Statement name="WriteScriptLogEntry" continueOnFail="false">
                        <Parameter xsi:type="StringParameter" name="Comment" value="#pulled# $intel-sa-00075$" />
                      </Statement>
                    </Else>
                  </If>
                </Else>
              </If>
            </Else>
          </If>
        </Then>
        <Else>
          <Statement name="WriteScriptLogEntry" continueOnFail="false">
            <Parameter xsi:type="StringParameter" name="Comment" value="Script error. Log file not generated." />
          </Statement>
        </Else>
      </If>
      <Statement name="ExecuteShellCommand" continueOnFail="false" osType="Windows">
        <Parameter xsi:type="StringParameter" name="Command" value="del /q /s #local#" />
        <Parameter xsi:type="EnumParameter" name="ExecuteAccount" value="System" />
        <Parameter xsi:type="BooleanParameter" name="Is64Bit" value="False" />
      </Statement>
    </Body>
  </Procedure>
</ScExport>
INTEL-SA-00075 Detection and Mitigation Tool Script

How to Download Scripts

Login Here

Search

Get In Touch!

Additional Resources

About Us
