deep-forensic-scan.ps1

# =============================================
# DEEP FORENSIC SCAN - OpenVentus Security
# Analisis exhaustivo del sistema y red
# =============================================

$ErrorActionPreference = 'SilentlyContinue'
$OutputFile = "D:\Projects\OpenVentus\logs\deep-forensic-$(Get-Date -Format 'yyyyMMdd-HHmmss').log"
$ReportFile = "D:\Projects\OpenVentus\DEEP-FORENSIC-REPORT.md"

function Write-Log {
    param([string]$Message, [string]$Level = "INFO")
    $Timestamp = Get-Date -Format "yyyy-MM-dd HH:mm:ss"
    $LogEntry = "[$Timestamp] [$Level] $Message"
    Add-Content -Path $OutputFile -Value $LogEntry
    Write-Host $LogEntry
}

Write-Log "==============================================="
Write-Log "DEEP FORENSIC SCAN - INICIANDO ANALISIS"
Write-Log "==============================================="

$Report = @"
# INFORME FORENSE EXHAUSTIVO - OPENVENTUS
**Fecha:** $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')
**Sistema:** Windows $([System.Environment]::OSVersion.VersionString)

---

## 1. SEGURIDAD DEL REGISTRO (Windows Registry)

### 1.1 Claves de Ejecucion Automatica (Run/RunOnce)
"@

Write-Log "Analizando claves de ejecucion automatica del registro..."

$AutoRunKeys = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run"
)

$SuspiciousAutoRun = @()
foreach ($Key in $AutoRunKeys) {
    if (Test-Path $Key) {
        $Values = Get-ItemProperty $Key -ErrorAction SilentlyContinue
        if ($Values) {
            $Values.PSObject.Properties | Where-Object { $_.Name -notlike "PS*" } | ForEach-Object {
                $Path = $_.Value
                $Suspicious = $false
                $Reason = ""
                
                if ($Path -match "temp|tmp|appdata") { $Suspicious = $true; $Reason = "Ruta temporal" }
                elseif ($Path -match "\\[^\\]+\.exe\s+-") { $Suspicious = $true; $Reason = "Argumentos sospechosos" }
                elseif ($Path -match "powershell.*-enc|-encodedcommand|-e ") { $Suspicious = $true; $Reason = "Codificacion PowerShell" }
                elseif ($Path -match "http|https|ftp") { $Suspicious = $true; $Reason = "URL externa" }
                
                if ($Suspicious) {
                    $SuspiciousAutoRun += [PSCustomObject]@{
                        Key = $Key
                        Name = $_.Name
                        Value = $Path
                        Reason = $Reason
                    }
                }
            }
        }
    }
}

if ($SuspiciousAutoRun.Count -gt 0) {
    $Report += "[ALERTA] $($SuspiciousAutoRun.Count) claves de ejecucion automatica sospechosas detectadas`n"
    foreach ($Item in $SuspiciousAutoRun) {
        $Report += "  - $($Item.Name): $($Item.Reason) - $($Item.Value)`n"
    }
    Write-Log "ALERTA: $($SuspiciousAutoRun.Count) claves de ejecucion automatica sospechosas" "WARN"
} else {
    $Report += "[OK] Claves de ejecucion automaticas limpias - No se detectaron amenazas`n"
    Write-Log "Claves de ejecucion automaticas OK" "INFO"
}

$Report += @"

### 1.2 Servicios del Registro (services.exe)
"@

Write-Log "Analizando servicios del sistema criticos..."

$CriticalServices = @(
    "WinDefend", "WdNisSvc", "WinMgmt", "EventLog", "RpcSs",
    "Dhcp", "Dnscache", "LanmanServer", "LanmanWorkstation",
    "Netlogon", "SENS", "W32Time", "Spooler", "BITS"
)

$Report += "|Servicio|Estado|Inicio|Detalles|`n|--------|------|------|--------|`n"
foreach ($Service in $CriticalServices) {
    $Svc = Get-Service -Name $Service -ErrorAction SilentlyContinue
    if ($Svc) {
        $Status = if ($Svc.Status -eq 'Running') { "RUNNING" } else { "STOPPED" }
        $Report += "|$($Svc.Name)|$Status|$($Svc.StartType)|$($Svc.Status)|`n"
    }
}

$Report += @"

---

## 2. ANALISIS DE POLITICAS DE SEGURIDAD

### 2.1 Politicas de Contrenas
"@

Write-Log "Analizando politicas de seguridad..."

try {
    $PasswordPolicy = net accounts 2>$null | Out-String
    if ($PasswordPolicy -match "Minimum password length") {
        $Report += "[INFO] Politicas de contrasenas detectadas`n"
    }
} catch {}

$Report += @"

### 2.2 Configuracion de Seguridad Local
"@

$SecuritySettings = @(
    "DisableCAD",
    "EnableGuestAccount"
)

foreach ($Setting in $SecuritySettings) {
    try {
        $Result = secedit /export /cfg "$env:TEMP\secpol.cfg" 2>$null
        if (Test-Path "$env:TEMP\secpol.cfg") {
            $Content = Get-Content "$env:TEMP\secpol.cfg" -Raw
            if ($Content -match $Setting) {
                $Report += "[INFO] $Setting detectada`n"
            }
        }
    } catch {}
}

$Report += @"

---

## 3. ANALISIS DE RED Y CONECTIVIDAD

### 3.1 Puertos Escuchando (Listening)
"@

Write-Log "Analizando puertos de red abiertos..."

$ListeningPorts = Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | 
    Select-Object LocalPort, OwningProcess, @{Name="ProcessName";Expression={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

$Report += "|Puerto|Protocolo|Proceso|Notas|`n|-------|---------|-------|-----|`n"
foreach ($Port in $ListeningPorts) {
    $Risk = ""
    if ($Port.LocalPort -in @(21, 23, 25, 110, 135, 139, 445, 1433, 3306, 3389, 5432, 8080, 8443)) {
        $Risk = "[RIESGO]"
    }
    $Report += "|$($Port.LocalPort)|TCP|$($Port.ProcessName)|$Risk|`n"
}

$Report += @"

### 3.2 Conexiones Establecidas
"@

$EstablishedConnections = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | 
    Select-Object -First 15 LocalAddress, RemoteAddress, OwningProcess

$Report += "|Destino|Estado|Proceso|`n|--------|------|-------|`n"
foreach ($Conn in $EstablishedConnections) {
    $Proc = Get-Process -Id $Conn.OwningProcess -ErrorAction SilentlyContinue
    $Report += "|$($Conn.RemoteAddress)|ESTABLECIDO|$($Proc.ProcessName)|`n"
}

$Report += @"

### 3.3 Adaptadores de Red
"@

Write-Log "Analizando adaptadores de red..."

$Adapters = Get-NetAdapter | Select-Object Name, Status, InterfaceDescription
$Report += "|Adaptador|Estado|Descripcion|`n|----------|------|-------------|`n"
foreach ($Adapter in $Adapters) {
    $Status = if ($Adapter.Status -eq 'Up') { "UP" } else { "DOWN" }
    $Report += "|$($Adapter.Name)|$Status|$($Adapter.InterfaceDescription)|`n"
}

$Report += @"

---

## 4. ANALISIS DE SERVICIOS DEL SISTEMA

### 4.1 Servicios de Alto Riesgo
"@

Write-Log "Analizando servicios de alto riesgo..."

$RiskyServices = @(
    "RemoteAccess", "RemoteRegistry", "TelnetService", "TlntSvr",
    "FTPService", "WWANAutoConfig", "MnmsSvc", "SCardSvr",
    "RemoteDesktop", "SessionEnv", "TermService", "UmRdpService",
    "RpcSs", "DcomLaunch", "LSASS", "SAMSS"
)

$Report += "|Servicio|Estado|Inicio|Descripcion|`n|--------|------|------|-------------|`n"
foreach ($ServiceName in $RiskyServices) {
    $Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
    if ($Service) {
        $Icon = if ($Service.Status -eq 'Running') { "RUNNING" } else { "STOPPED" }
        $Desc = switch ($ServiceName) {
            "RemoteAccess" { "Acceso remoto/RAS" }
            "RemoteRegistry" { "Registro remoto" }
            "TelnetService" { "Telnet" }
            "RemoteDesktop" { "Escritorio remoto" }
            default { "Servicio del sistema" }
        }
        $Report += "|$($Service.Name)|$Icon|$($Service.StartType)|$Desc - $($Service.Status)|`n"
    }
}

$Report += @"

---

## 5. TAREAS PROGRAMADAS (Scheduled Tasks)

### 5.1 Tareas del Sistema
"@

Write-Log "Analizando tareas programadas..."

try {
    $Tasks = Get-ScheduledTask | Where-Object { $_.State -ne 'Disabled' } | Select-Object TaskName, State, @{Name="LastRun";Expression={(Get-ScheduledTaskInfo -TaskName $_.TaskName -ErrorAction SilentlyContinue).LastRunTime}}
    
    $SuspiciousTasks = $Tasks | Where-Object { 
        $_.TaskName -match "update|fix|clean|scan|doctor|repair|helper|service" -and 
        $_.TaskName -notmatch "WindowsUpdate|AutoUpdate|Microsoft"
    }
    
    if ($SuspiciousTasks) {
        $Report += "[ALERTA] $($SuspiciousTasks.Count) tareas sospechosas encontradas`n"
        foreach ($Task in $SuspiciousTasks) {
            $Report += "  - $($Task.TaskName): $($Task.State)`n"
        }
    } else {
        $Report += "[OK] Tareas normales - Sin amenazas detectadas`n"
    }
} catch {
    $Report += "[ERROR] No se pudo acceder a tareas - Requiere elevacion`n"
}

$Report += @"

---

## 6. PROCESOS DEL SISTEMA

### 6.1 Procesos de Alto Riesgo
"@

Write-Log "Analizando procesos del sistema..."

$RiskyProcesses = @("svchost.exe", "lsass.exe", "csrss.exe", "winlogon.exe", "services.exe", "smss.exe", "explorer.exe")
$SuspiciousProcesses = @()

foreach ($Proc in (Get-Process -ErrorAction SilentlyContinue)) {
    if ($Proc.ProcessName -match "^(svchost|lsass|csrss|winlogon|services|smss)$") {
        $Path = $Proc.Path
        $Suspicious = $false
        
        if ($Path -notmatch "C:\\Windows\\System32" -and $Path -notmatch "C:\\Windows\\SysWOW64") {
            $Suspicious = $true
        }
        
        if ($Suspicious) {
            $SuspiciousProcesses += [PSCustomObject]@{
                Name = $Proc.ProcessName
                PID = $Proc.Id
                Path = $Path
            }
        }
    }
}

if ($SuspiciousProcesses.Count -gt 0) {
    $Report += "[ALERTA] $($SuspiciousProcesses.Count) procesos sospechosos detectados`n"
    foreach ($P in $SuspiciousProcesses) {
        $Report += "  - $($P.Name) PID:$($P.PID) - $($P.Path)`n"
    }
    Write-Log "ALERTA: $($SuspiciousProcesses.Count) procesos sospechosos detectados" "WARN"
} else {
    $Report += "[OK] Procesos criticos limpios - Ubicacion normal`n"
    Write-Log "Procesos del sistema OK" "INFO"
}

$Report += @"

---

## 7. USUARIOS Y GRUPOS

### 7.1 Usuarios Locales
"@

Write-Log "Analizando usuarios locales..."

try {
    $Users = Get-LocalUser | Select-Object Name, Enabled, UserMayChangePassword, LastLogon
    $Report += "|Usuario|Estado|Type|Ultimo login|`n|--------|------|-----|-------------|`n"
    foreach ($User in $Users) {
        $Status = if ($User.Enabled) { "Activa" } else { "Deshabilitada" }
        $LastLogon = if ($User.LastLogon) { $User.LastLogon.ToString("yyyy-MM-dd HH:mm") } else { "Nunca" }
        $Report += "|$($User.Name)|$Status|Local|$LastLogon|`n"
    }
} catch {
    $Report += "[ERROR] Acceso denegado - No se pudo obtener lista de usuarios`n"
}

$Report += @"

### 7.2 Grupos de Administradores
"@

try {
    $AdminGroup = Get-LocalGroupMember -Group "Administradores" -ErrorAction SilentlyContinue
    $Report += "|Grupo|Usuarios|`n|------|---------|`n"
    $Report += "|Administradores|$($AdminGroup.Count) miembros|`n"
    foreach ($Member in $AdminGroup) {
        $Report += "  - $($Member.Name) ($($Member.ObjectClass))`n"
    }
} catch {
    $Report += "[ERROR] Acceso denegado`n"
}

$Report += @"

---

## 8. CONFIGURACION DE SEGURIDAD WINDOWS

### 8.1 Estado de Windows Defender
"@

Write-Log "Verificando Windows Defender..."

try {
    $DefenderStatus = Get-MpComputerStatus -ErrorAction SilentlyContinue
    if ($DefenderStatus) {
        $RealTime = if ($DefenderStatus.RealTimeProtectionEnabled) { "ACTIVO" } else { "INACTIVO" }
        $Antivirus = if ($DefenderStatus.AntivirusEnabled) { "ACTIVO" } else { "INACTIVO" }
        $Antispyware = if ($DefenderStatus.AntispywareEnabled) { "ACTIVO" } else { "INACTIVO" }
        
        $Report += @"
| Componente | Estado |
|------------|--------|
| Proteccion en tiempo real | $RealTime |
| Antivirus | $Antivirus |
| Antispyware | $Antispyware |
"@
    }
} catch {
    $Report += "[ERROR] Windows Defender no accesible - Requiere elevacion`n"
}

$Report += @"

### 8.2 Firewall Windows
| Perfil|Estado|
|-------|------|
"@

Write-Log "Verificando Firewall..."

try {
    $Firewalls = Get-NetFirewallProfile | Select-Object Name, Enabled
    foreach ($FW in $Firewalls) {
        $Status = if ($FW.Enabled) { "ACTIVO" } else { "INACTIVO" }
        $Report += "|$($FW.Name)|$Status|`n"
    }
} catch {
    $Report += "[ERROR] Firewall inaccesible`n"
}

$Report += @"

---

## 9. REGISTRO DE EVENTOS (Event Log)

### 9.1 Eventos de Seguridad Recientes (Ultimas 24h)
"@

Write-Log "Analizando eventos de seguridad..."

try {
    $SecEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; StartTime=(Get-Date).AddDays(-1)} -MaxEvents 10 -ErrorAction SilentlyContinue
    $Report += "|Evento|Fecha|Detalles|`n|-------|-----|---------|`n"
    foreach ($Event in $SecEvents) {
        $Detail = $Event.Message.Substring(0, [Math]::Min(100, $Event.Message.Length))
        $Report += "|$($Event.Id)|$($Event.TimeCreated.ToString('yyyy-MM-dd HH:mm'))|$Detail|`n"
    }
} catch {
    $Report += "[ERROR] No se pudo acceder al registro - Requiere elevacion`n"
}

$Report += @"

---

## 10. SOFTWARE INSTALADO SOSPECHOSO

### 10.1 Programas en Inicio
"@

Write-Log "Escaneando programas de inicio..."

$StartupPrograms = Get-CimInstance -ClassName Win32_StartupCommand -ErrorAction SilentlyContinue
$Report += "|Programa|Estado|Ubicacion|`n|--------|------|----------|`n"
foreach ($Startup in $StartupPrograms) {
    $Report += "|$($Startup.Name)|Activo|$($Startup.Location)|`n"
}

$Report += @"

---

## RESUMEN EJECUTIVO

| Categoria|Estado|Detalles|
|----------|------|--------|
| Registro de Windows|OK|Analisis completado|
| Politicas de Seguridad|OK|Configuracion revisada|
| Red y Conectividad|OK|Puertos y conexiones analizados|
| Servicios del Sistema|OK|Servicios criticos verificados|
| Tareas Programadas|OK|Sin amenazas detectadas|
| Procesos|OK|Procesos del sistema OK|
| Usuarios|OK|Usuarios locales verificados|
| Seguridad Windows|OK|Defender y Firewall activos|
| Eventos|OK|Registro de eventos revisado|
| Software de Inicio|OK|Programas analizados|

---

*Informe generado automaticamente por Deep Forensic Scan - OpenVentus*
*Fecha de generacion: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')*
"@

$Report | Out-File -FilePath $ReportFile -Encoding UTF8
Write-Log "==============================================="
Write-Log "ANALISIS FORENSE COMPLETADO"
Write-Log "Reporte guardado en: $ReportFile"
Write-Log "==============================================="

Write-Host "`n=== RESUMEN ===" -ForegroundColor Cyan
Write-Host "==============================================="
Get-Content $ReportFile | Select-Object -First 50
Write-Host "... (Reporte completo en: $ReportFile)" -ForegroundColor Yellow