I am trying to write a code to make my daily life easier :)
The code below works if I indicate the file path
$ stream_reader = New-Object System.IO.StreamReader {c:\test.txt}
However it does not work when I use a variable like:
$ stream_reader = New-Object System.IO.StreamReader {$FileIOC}
How to use it:
- Create a file text containing md5 entries
- Run the script and specify the file.
- Normally, a file name like : "randomID.ioc" will be created
Code
try {
$FileIOC = read-host "Where is located the text file containing iOC"
if (Test-Path $FileIOC) {
write-host "File found at:" $FileIOC
} else {
write-host "Unable to file iOC file into: " $FileIOC
}
}
catch {
#Write-Warning $_.Exception.Message
#Write-Host "Unable to find $hotfix"
}
try {
# GUI ID Generation
$GUID = [System.Guid]::NewGuid()
#[guid]::NewGuid()
Write-Host "Generating ID: " $GUID
}
catch {
Write-Warning $_.Exception.Message
}
# Variables
$gdate = Get-Date -format s
$Hostname = "$GUID.ioc"
# Where I am
$Locate = Get-Location
$Folder = "$Locate\"
#write-host "Path :" $Folder
# Create file format GUID.ioc (# create xml)
# `n <== Enter
New-Item -path $Folder -name $Hostname -type "file" -value "<?xml version=""1.0"" encoding=""utf-8""?>"
Add-Content -path $Folder$Hostname -value "`n<ioc xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" id=""$GUID"" last-modified=""$gdate"" xmlns=""http://schemas.mandiant.com/2010/ioc"">"
Add-Content -path $Folder$Hostname -value " <short_description>Custom EDR-O iOC</short_description>"
Add-Content -path $Folder$Hostname -value " <short_description>Custom EDR-O iOC $Hostname $gdate</short_description>"
Add-Content -path $Folder$Hostname -value " <keywords />"
Add-Content -path $Folder$Hostname -value " <authored_by>LEFBE</authored_by>"
Add-Content -path $Folder$Hostname -value " <authored_date>$gdate</authored_date>"
Add-Content -path $Folder$Hostname -value " <links />"
Add-Content -path $Folder$Hostname -value " <definition>"
# For each line in text files
# Generate ID
$GUID1 = [guid]::NewGuid()
Add-Content -path $Folder$Hostname -value " <Indicator operator=""OR"" id=""$GUID1"">"
$stream_reader = New-Object System.IO.StreamReader{"$FileIOC"} #< Here a problem variable was note read by $stream_reader
while (($current_line =$stream_reader.ReadLine()) -ne $null)
{
Write-Host "$current_line"
$line_number++
$GUID2 = [guid]::NewGuid()
Add-Content -path $Folder$Hostname -value " <IndicatorItem id=""$GUID2"" condition=""is"">"
Add-Content -path $Folder$Hostname -value " <Context document=""FileItem"" search=""FileItem/Md5sum"" type=""mir"" />"
Add-Content -path $Folder$Hostname -value " <Content type=""md5"">$current_line</Content>"
Add-Content -path $Folder$Hostname -value " </IndicatorItem>"
}
Add-Content -path $Folder$Hostname -value " </Indicator>"
Add-Content -path $Folder$Hostname -value " </definition>"
Add-Content -path $Folder$Hostname -value "</ioc>"
Write-Host ""
Write-Host "iOC file can be found at this location:" "$Folder$Hostname"
Do you have any idea ?
New-Object -TypeName System.IO.StreamReader -ArgumentList $pathor even better:[System.IO.StreamReader]::new($path)