Blocking Cyber Attacks on Windows Servers using CyberArms software and PowerShell scripts

Recently the number of audit failures on our Remote Desktop and IIS servers has increased drastically in the last month.
List of IP addresses found here.
Found this program for our 2012 servers (or any RDP using TLS)

CyberArms Intrusion Detection and Defence System

Default config...
After 3 failed login attempts, it would temporarily block the IP for 20 minutes. (Soft Lock)
After 10 login attempts, it would block the IP for 24 hours. (Hard lock)
-There is the option to hard lock the IP address forever.

Issues
1) No option to customized notification emails. -wanted to include
2) Cannot white-list a service provider only IP addresses.
3) No Response to inquiry about their products and licensing.

Since the program creates an event log for when it blocks the IP address, a PowerShell script was created to add firewall rules (permanent rules) and send email notifications out with detailed information.

The original PowerShell script just sent out emails with the server name when an event log with 4001 or 9001 is created in the "CyberArms" event log.

It worked great on our 2012 servers, however 2008 stored the Event log data with extra returns and spaces in the IP addresses.  In testing it caused the local network to be blocked via firewall.  Good thing it was a virtual machine and could still be access through Virtual Center.

Updated the PowerShell script to distinguish between 2008 and 2012 servers.

Another VBscript was created to manually delete any firewalls from 'trusted' IP addresses using netsh from another computer.

After the first weekend having to check each IP address and manually delete the rules got old and time consuming.

The next revision of the script added NSlookup to a ProviderLookup function in the script.

The ProviderLookup function was created to allow certain IP addresses or provider names (provided by NSLookup) to be unblocked automatically.

Example if NSlookup returned a provider name with "Domain.ca" in it, then we trusted it and the firewall was deleted.

Emails now include the IP address, the provider information and if the rule was deleted.

Steps...
Install CyberArms software
Enable any security agents in CyberArms
Download PowerShell Script "CyberArms Eventlog Script.txt"
- Rename to .PS1 and change "DOMAIN.CA" and email settings.
Create Task Sequence to run the script when event 4001 or 9001 is logged.

Update - April 21, 2015

The ProviderLookup function will now include Country and ISP information extracted from http://ipaddress.com if it cannot find a DNS name for the IP address.

Future options
1) Create the same firewall rule on more that one server via PowerShell Array variable.
2) Create a pause between rule creation and rule deletion, just in case there was malicious intentions.
- probably use a ping command to 127.0.0.1 for 10 minutes then have it delete the rule.

3) Working on cleaning up the ProviderLookup function so that certain ISP names will be allowed.

Removing a Lync Contact using Powershell and XML

Back in February I posted about adding contacts to Lync Groups.
However, what happens when you spell the contact address wrong and you just imported that into your 1000+ clients contact list...

Well, you need to find a way to remove the contact from the XML file.
I could have restored the backup files to the user accounts... but didn't think of that until I got this solution working. *

After trying to create an XML script tath use the same script in the previous post, but this time we will replace the offending string with blanks.

Add this to the Configurable Variables section
#Delete this line from XML
$Variable = @'
<Contact Buddy="contact@domain.com" SubscribePresence="1" Groups="1 20" />
'@
$CommonContact = "contact@domain.com" # The one that is spelled wrong.

In the Process-Contacts Function,

Change If ($ContactsToAdd) to If ($ContactsToAdd) 

Remove the $ContactsToAdd section and replace it with.

$DeleteRecord = (Get-Content "$WorkingFolder\DocItemSet.xml") |
    ForEach-Object {$_ -replace $Variable, ""} |
    Set-Content "$WorkingFolder\DocItemSet.xml"

* This does remove the contact from the user's visual list of contacts.  However, when the user's contact info is exported, the old contact is still there just not listed in any groups which is why it doesn't appear in the client.

In short, double check spelling and try it on a test account.

To change the script from all users to 1 users change...
$AllSipAddresses = Get-CsUser -Identity lyncroom@domain.com -Filter {Enabled -eq $True} | Select SipAddress | %{$_.SipAddress.Replace('sip:','')}

Original Post about adding groups found here on Roland Paix's IT Blog

More on the custom Lync rooms found here.

Intel NUC and SCCM issues

We purchased a couple of the Intel NUC mini desktops (model NUC5i3RYK) for our custom Lync Room systems.

Deploying with Microsoft System Center Configuration Manager...

Same with any new system... the Window PE boot image needed new drivers for the Ethernet adapter. (In our case the 64 bit driver - e1d64x64.inf)

Created a driver pack for the Intel NUC system, however the drivers were not getting installed into the image by the "Apply Device Drivers" task.

Decided to try the "Apply Driver Package" and picked the Intel NUC package option to see what would happen.

Now the task sequence fails with...
This task sequence cannot be run because a package referenced by the task sequence could not be found. For more information, please contact your system administrator or helpdesk operator.

Using F8 and cmtrace to open the \windows\temp\SMSTS.log file and found this error message...
Failed to resolve selected task sequence dependencies. Code(0x80040104)

Found this website and updated the distribution points so that the source version number would not be '1' and now the task sequence is working and drivers are installing.

More SCCM related posts

SCCM Task Sequence User Verification

We know that Config Manager's Task Sequences run with a system account and can only be advertised to Device collections.

What if we wanted only certain people to have permission to re-image their computer?

This script will record the logged in username via wmi as a Task Variable.
If that account is a member of a specific domain group then the 'ValidUser' Task Variable will be set as True.

You can then use that 'ValidUser' Task Variable to allow groups or other commands/applications to run.

To test the sequence with the msgbox dialogs you will need the ServiceUI.exe file from the Microsoft Development kit.

'Find Logged in user
'Version 1.60
on error resume next
Dim objNetwork, objDomain, oTaskSequence
'msgbox "Testing"
'Create Objects
Set objNetwork = CreateObject("Wscript.Network")
Set objDomain = GetObject("LDAP://RootDSE")
Set oTaskSequence = CreateObject ("Microsoft.SMS.TSEnvironment")

' Obtain user information.
'strUserName = objNetwork.UserName
strcomputer = "."

Set objWMI = GetObject("winmgmts:" & "{impersonationLevel=impersonate}!\\" & strComputer & "\root\cimv2") 
Set colSessions = objWMI.ExecQuery ("Select * from Win32_ComputerSystem",,48) 
For Each objItem in colSessions 
if objItem.Username <> "" then
strUserName = Replace(Lcase(objItem.UserName),"prairiesouth","")
oTaskSequence("UserName") = replace(strUserName,chr(92),"")
'msgbox strUserName
else
strUserName = objNetwork.UserName
end if
next

If not lcase(strUserName) = "system" then
'Verifies not the System account.
strDomain = objDomain.Get("dnsHostName")
Set objUser = GetObject("WinNT://" & strDomain & "/" & strUserName)
For Each strGroup in objUser.Groups
If Lcase(strGroup.Name) = "help desk end users" or Lcase(strGroup.Name) = "information technology department" then
strValid = 1
oTaskSequence("UserGroup") = strGroup.Name
'msgbox strGroup.Name
exit for
end if
Next
else
strValid = 0
end if

If strValid = 1 then
oTaskSequence("ValidUser") = "True"
'msgbox strValid
Else
oTaskSequence("ValidUser") = "False"
'msgbox strValid
end if

More SCCM related posts

Bulk Import Custom Contact Groups into Lync User accounts

Was looking for a way to Populate our Lync Room systems into end users Lync Contacts as a group rather than a bunch of individual accounts.  (More on Lync Room Systems here http://bit.ly/netadmlr)

Based on the PowerShell script found below, a new section was created for the Contact Groups.
http://rp-it.blogspot.ca/2014/02/automatically-populate-contacts-for-all-lync-2013-users.html

Rather than repost the entire code, here's the updated sections...
For each Lync group that you want to create I would suggest creating new scripts.

For Individual account testing...

#Old version Enable for All users Disable for individual testing

$AllSipAddresses = Get-CsUser -Filter {Enabled -eq $True} | Select SipAddress | %{$_.SipAddress.Replace('sip:','')}

#GM Added - Enable for individual testing

#$AllSipAddresses = Get-CsUser -Identity lastname.first@domain.com -Filter {Enabled -eq $True} | Select SipAddress | %{$_.SipAddress.Replace('sip:','')}

# Common Contacts - Enable and populate this variable with a set of Lync contacts to distribute to all users instead of distributing all users to all users. Overrides $DontAddUsers.

#$CommonContacts = "lrs1@domain.com","lrs2@domain.com"

To add /verify the Group exists.

$AllContacts = @($SipAddressesToAdd | ?{$_ -ne $User})

    [xml]$XMLFile = Get-Content "$WorkingFolder\DocItemSet.xml"

    $XMLPart = $XMLFile.DocItemSet.DocItem | ?{$_.Name -like "urn:lcd:*"}

    $XMLNode = $XMLPart.Data.HomedResource.Contacts

$XMLNodeGroup = $XMLPart.Data.HomedResource.ContactGroups #GM

    $ExistingContacts = @($XMLNode.Contact | Select -ExpandProperty Buddy)

$ExistingContactGroups = @($XMLNodeGroup.ContactGroup | Select -ExpandProperty DisplayName) #GM

#GM Lync Rooms Contact Group Add

If($ExistingContactGroups){

If($ExistingContactGroups -eq "THluYyBSb29tcw=="){

write-host "`r`nLync Room Group Exists. Nothing changed.`r`n"

}

Else{

write-host "`r`nLync Room Group will be added.`r`n"

[System.XML.XMLLinkedNode]$NewContactGroup = $XMLFile.CreateElement('ContactGroup','http://schemas.microsoft.com/RtcServer/2002/11/dbimpexp')

            $NewContactGroup.SetAttribute('Number','20') #High number so as to not overwrite existing groups.

            $NewContactGroup.SetAttribute('DisplayName','CodeFromXML')

            #Display name in ContactGroups found in XMl file in test account

            #Export-CsUserData -PoolFqdn "lyncserver.domain.com" -UserFilter name@domain.com -FileName "c:\scripts\test.zip"

            $XMLNodeGroup.AppendChild($NewContactGroup)

        }

}

Else{

write-host "`r`nNo existing contact groups found.`r`n"

write-host "`r`nAdding New Contact Group XML Element.`r`n"

[System.XML.XMLLinkedNode]$NewNodeGroup = $XMLFile.CreateElement('ContactGroups','http://schemas.microsoft.com/RtcServer/2002/11/dbimpexp')

            [System.XML.XMLLinkedNode]$NewContactGroup = $XMLFile.CreateElement('ContactGroup','http://schemas.microsoft.com/RtcServer/2002/11/dbimpexp')

            $NewContactGroup.SetAttribute('Number','20') #High number so as to not overwrite existing groups.

            $NewContactGroup.SetAttribute('DisplayName','CodeFromXML')

            $NewNodeGroup.AppendChild($NewContactGroup)

            $XMLCGroup = $XMLPart.Data.HomedResource.Containers

            $XMLPart.Data.HomedResource.InsertBefore($NewNodeGroup,$XMLCGroup)

            $XMLFile.Save("$WorkingFolder\DocItemSet.xml")

            [xml]$XMLFile = Get-Content "$WorkingFolder\DocItemSet.xml"

            $XMLPart = $XMLFile.DocItemSet.DocItem | ?{$_.Name -like "urn:lcd:*"}

            $XMLNode = $XMLPart.Data.HomedResource.Contacts

}

#Back to original code

    Write-Host "`r`nExisting contacts:`r`n" 

Change these lines to include 1 and the group number in the $ContactstoAdd | foreach{} section

$NewContact.SetAttribute('Groups','1 20') 

If you have a large organization, you will need to create a new policy or edit the Global Presence policy.  Once all the Lync users had the Lync Rooms in the list, the "Maximum Followers Reached" error showed up on the Lync Room systems.

A new Presence Policy was created and applied to the Lync Room accounts. The MaxCategorySubcriptions was to 3000 and the error went away.

 Since it was only applied to the Lync Room systems it should not drastically increase the server traffic as compared to applying to all our Lync users.

http://blogs.catapultsystems.com/drowe/archive/2013/01/15/too-popular-for-lync-maximum-followers-reached.aspx

SCCM 2012 Hard Drive with Bad Blocks Baseline

This PowerShell script will detect systems where the main hard drive is developing bad blocks.
Or as I call it, the "Click of Death".

Continuing with my previous posts on SCCM 2012 baselines items...
http://gmnetadmin.blogspot.ca/2015/01/using-sccm-2012-compliance-settings-to.html

Same steps as Option 2 in the above mentioned post but using the discovery script below...
Changes...

1. You can add more If statements or expand it use ElseIf to record bad blocks from other hard drives.
2. Or change the text in the If statement to just '*bad block*' to count all bad blocks event entries.

#Version 1.00 Feb 2, 2015
#SCCM Baseline for Bad Block on C Drive
$AllEvents = 0

#Default Event Logs
$Provider = "Disk"
$HourChange = 24 
$TimeNow = [DateTime]::Now
$TimeChange = [DateTime]::Now.AddHours(-$HourChange)

#Check Event Log for errors
$EventLogNames = "System"

ForEach ($log in $EventLogNames){
    $entry = " " 
    #Search Event Logs
    
    $LogEntry = Get-WinEvent -LogName $log | Where-Object {$_.timeCreated -ge $TimeChange -and $_.ProviderName -eq $Provider}
        ForEach ($entry in $LogEntry){
            $EvLevel = "Level: `t" + $entry.LevelDisplayName + $nl
            $EvEventID = "EventID: `t" + $entry.ID + $nl
            $EvMessage = "Message: `t" + $entry.Message
            $EvSource = "Source: `t" + $entry.ProviderName + $nl
            $EvTime = "Time Created: `t" + $entry.TimeCreated + $nl
            #write-host $EvLevel + $EvEventID + $EvMessage + $EvSource +$EvTime + $nl

           If ($EvMessage -like '*The device, \Device\Harddisk0\DR0, has a bad block*'){
                $AllEvents += 1
            }
                        
        }

}
write-host $AllEvents


More SCCM related posts

SCCM 2012 Task Sequence for Failing Hard Drive

Now that you have collections created based S.M.A.R.T diagnostics or Disk event log entries baselines for failing hard drives... (See previous post)

We can create a custom Task Sequence to notify the user of the problem, when they log onto the computer.

Optionally, you could also deploy this as an available task sequence, for end users to manually check hard drive status.

Here are my suggestions for the task sequence...

Name: Hard Drive Diagnostic
Progress notification text: "Please submit a help desk ticket if the hard drive reports as failing."  (or use the standard "Running: <Task sequence name>")
Suppress task sequence notifications - Optional
Maximum run time: 5 minutes
Run on any platform.

Sequence of Tasks... (Keep in mind that the "Name" is what the end user will see on the screen)

1. Set Task Sequence Variable
1. Name: Testing hard drive health. Please wait.
2. Variable: HD Failure
3. Value: True
4. Options:Add a WMI query Condition
1. WMI Namespace: root\wmi
2. WQL Query: select * from MSStorageDriver_FailurePredictStatus Where PredictFailure = True
2. Group 1:
1. Name: Hard Drive Diagnostic Finished
2. Options: Add a Task Sequence Variable
1. Variable: HD Failure
2. Condition: Equals
3. Value: True
3. Run Command Line (Under Group 1)
1. Name: The hard drive is failing
2. Command line: ping 127.0.0.1 -n 30
1. Should last about 30 seconds on the screen
4. Run Command Line (Under Group 1)
1. Name: We recommend replacing the hard drive.
2. Command line: ping 127.0.0.1 -n 30
1. Should last about 30 seconds on the screen
3. Group 2:
1. Name: Hard drive Diagnostics Finished
2. Options: Add a Task Sequence Variable
1. Variable: HD Failure
2. Condition: Not Exists
3. Run Command Line (Under Group 1)
1. Name: Hard drive passed diagnostics
2. Command line: ping 127.0.0.1 -n 10
1. Should last about 10 seconds on the screen.

More SCCM related posts