XMR Endpoint Check

<?xml version="1.0" encoding="utf-8"?>
<ScExport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns="http://www.kaseya.com/vsa/2008/12/Scripting">
  <Procedure name="XMR Endpoint Check" treePres="3" id="1628107456" folderId="520305531993651" treeFullPath="XMR">
    <Body description="Procedure to check the endpoints for the mining exploit.&#xA;Created by Douglas Sanchez (douglas.sanchez@kaseya.com)&#xA;&#xA;You MUST create a custom field called &quot;XMR&quot; as documented in Kaseya's article&#xA;https://helpdesk.kaseya.com/hc/en-gb/articles/360000346651-XMR-Detection-and-Removal-Procedures&#xA;&#xA;1-29-18  Modified by Chris A - Virtual Administrator to add Tags, and reduce un-needed entries">
      <Statement name="GetVariable" continueOnFail="false">
        <Parameter xsi:type="EnumParameter" name="VariableType" value="AgentTempDirectory" />
        <Parameter xsi:type="StringParameter" name="SourceContent" value="" />
        <Parameter xsi:type="StringParameter" name="VariableName" value="agentDir" />
      </Statement>
      <If description="Check for the registry keys">
        <Condition name="Windows 32 or 64 Bit Check">
          <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
        </Condition>
        <Then>
          <If description="">
            <Condition name="TestRegistryKey64">
              <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
            </Condition>
            <Then>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit found. $XMR$ $OOD$" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a found.. $XMR$ $OOD$" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b found.. $XMR$ $OOD$" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c found. . $XMR$ $OOD$" />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey64">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d found. . $XMR$ $OOD$" />
                  </Statement>
                </Then>
              </If>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected  $XMR$ $OOD$" />
              </Statement>
              <Statement name="UpdateSystemInfo" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
              </Statement>
            </Then>
            <Else>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="OK $XMR$" />
              </Statement>
              <Statement name="UpdateSystemInfo" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                <Parameter xsi:type="StringParameter" name="Value" value="OK" />
              </Statement>
            </Else>
          </If>
        </Then>
        <Else>
          <If description="">
            <Condition name="TestRegistryKey">
              <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts" />
              <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
            </Condition>
            <Then>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\ScriptInit found." />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\a found." />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\b found." />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\c found." />
                  </Statement>
                </Then>
              </If>
              <If description="">
                <Condition name="TestRegistryKey">
                  <Parameter xsi:type="StringParameter" name="Path" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d" />
                  <Parameter xsi:type="EnumParameter" name="Condition" value="Exists" />
                </Condition>
                <Then>
                  <Statement name="WriteScriptLogEntry" continueOnFail="false">
                    <Parameter xsi:type="StringParameter" name="Comment" value="HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PowerShell\Scripts\d found." />
                  </Statement>
                </Then>
              </If>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="System Affected $XMR$ $OOD$" />
              </Statement>
              <Statement name="UpdateSystemInfo" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                <Parameter xsi:type="StringParameter" name="Value" value="System Affected" />
              </Statement>
            </Then>
            <Else>
              <Statement name="WriteScriptLogEntry" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="Comment" value="OK $XMR$" />
              </Statement>
              <Statement name="UpdateSystemInfo" continueOnFail="false">
                <Parameter xsi:type="StringParameter" name="ColumnName" value="XMR" />
                <Parameter xsi:type="StringParameter" name="Value" value="OK" />
              </Statement>
            </Else>
          </If>
        </Else>
      </If>
    </Body>
  </Procedure>
</ScExport>
XMR Endpoint Check

How to Download Scripts

Login Here

Search

Get In Touch!

Additional Resources

About Us
