Windows 10 Windows 10 Powershell based virus detector

# Process_Bouncer.ps1
$main_conf_dir="$env:ProgramData\Malwark\Process_Bouncer"
$log_file="$main_conf_dir\action.log"
$white_file="$main_conf_dir\whitelist"
$black_file="$main_conf_dir\blacklist"

Function New-Configuration
{
    If (-Not (Test-Path $main_conf_dir))
    {
        New-Item -Path $main_conf_dir -ItemType Directory
    }
    If (-Not (Test-Path $log_file))
    {
        New-Item -Path $log_file -ItemType File
    }
    If (-Not (Test-Path $white_file))
    {
        New-Item -Path $white_file -ItemType File
    }
    If (-Not (Test-Path $black_file))
    {
        New-Item -Path $black_file -ItemType File
    }
}

Function Create-NotificationBallon([string]$Message, [string]$Title)
{
    [void] [System.Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms")

    $objNotifyIcon = New-Object System.Windows.Forms.NotifyIcon

    $objNotifyIcon.Icon = "C:\Windows\ProgressError.ico"
    $objNotifyIcon.BalloonTipIcon = "Error"
    $objNotifyIcon.BalloonTipText = "$Message"
    $objNotifyIcon.BalloonTipTitle = "$Title"
    $objNotifyIcon.Visible = $True
    $objNotifyIcon.ShowBalloonTip(5000)
}


Function Search-BWList([string]$Hash, [string]$SearchList)
{
    $list = Get-Content $SearchList

    ForEach ($entry In $list)
    {
        If ( $Hash -eq $entry) { return $true }
    }
    return $false
}

Function Get-UnsignedProcesses()
{
    # Get current list of unique running processes based on execution path
    $procs = gwmi -Query 'select ExecutablePath,ProcessID from win32_process'
   
    $unsigned = New-Object System.Collections.ArrayList

    ForEach($proc In $procs)
    {
        $proc_exe_path = $proc.ExecutablePath
        If ($proc_exe_path -eq $null) { continue }
        If ($proc_exe_path -eq "") { continue }
        # Create a list of unsigned binaries for scanning
        $auth_code = Get-AuthenticodeSignature $proc_exe_path
        If ($auth_code.Status -ne "Valid")
        {
            $hash = (Get-FileHash -Path $proc_exe_path -Algorithm SHA1).Hash
            If ( -Not (Search-BWList -SearchList $white_file -Hash $hash))
            {
                New-LogAction -Message "A new unsigned process was detected: $proc_exe_path"
                $proc_obj = New-Object -TypeName psobject
                $proc_obj | Add-Member -MemberType NoteProperty -Name ExecutablePath -Value $proc.ExecutablePath
                $proc_obj | Add-Member -MemberType NoteProperty -Name ProcessID -Value $proc.ProcessID
                $proc_obj | Add-Member -MemberType NoteProperty -Name Hash -Value $hash
                $unsigned.Add($proc_obj) > null
            }           
        }
    }
    return $unsigned
}

Function Get-ProcessReport([string]$FilePath, [string]$Hash)
{
    Get-VirusTotalReport -Hash $hash -Apikey FFFFFFFFFFFFFFFFFFF
}

Function New-LogAction([string]$Message)
{
    # Add in code to check log size and rotate log files (keep 5 log files)
    $main_log_size = $(Get-ChildItem -Path $log_file | Measure-Object -Property Length -Sum).Sum

    If (($main_log_size / 1MB) -gt 1)
    {
        $log_count = @(Get-ChildItem -Path $main_conf_dir -Filter "*action*").Count
        $log_count--

        If ($log_count -ge 4)
        {
            Remove-Item -Path "$log_file.$($log_count)"
            $log_count--
        }
        While($log_count -ge 0)
        {
            If ($log_count -eq 0)
            {
                Rename-Item -Path "$log_file" -NewName "$log_file.$($log_count+1)"
            }
            else
            {
                Rename-Item -Path "$log_file.$log_count" -NewName "$log_file.$($log_count+1)"
            }
            $log_count--
        }
        New-Item -Path $log_file -ItemType File
    }

    # Add an action event to the log
    Add-Content -Path $log_file -Value "$((Get-Date).ToString())    -----    $Message"
}

Function Get-VirusTotalReport
{
    param([string]$Hash, [string]$ApiKey)
   
    $body = @{ resource = $hash; apikey = $ApiKey }
    $Report = Invoke-RestMethod -Method 'POST' -Uri 'https://www.virustotal.com/vtapi/v2/file/report' -Body $body

    return $Report
}

Function Main
{
    New-Configuration

    $suspect_procs = Get-UnsignedProcesses
    ForEach ($proc In $suspect_procs)
    {
        $proc_exe_path = $proc.ExecutablePath
        If ($proc_exe_path -eq $null) { continue }
        If ($proc_exe_path -eq "") { continue }
        $hash = $proc.Hash

        If ($(Search-BWList -SearchList $black_file -Hash $hash) -eq $true)
        {
            "Black Listed $proc_exe_path"
            New-LogAction -Message "[BLACKLIST DETECTION]  $proc_exe_path HASH: $hash was found in the blacklist."

            #"Kill the process"
            "Stopping $proc_exe_path"
            Stop-Process -Id $proc.ProcessId 2> $kill_error
            If ($?)
            {
                Create-NotificationBallon -Message "Blacklisted process detected and killed. Process: $proc_exe_path" -Title "Process Killed"
                New-LogAction -Message "[PROCESS KILL](Success)  $proc_exe_path HASH: $hash"
            } else
            {
                New-LogAction -Message "[PROCESS KILL](Failed)  $proc_exe_path HASH: $hash  ERROR: $kill_error"
            }
           
            continue
        } ElseIf ( $(Search-BWList -SearchList $white_file -Hash $hash) -eq $true )
        {
            "White Listed $proc_exe_path"
            New-LogAction -Message "[WHITELIST DETECTION]  $proc_exe_path HASH: $hash was found in the whitelist."
            continue
        }

        $report = Get-ProcessReport -FilePath $proc_exe_path -Hash $hash

        If ($report.positives -eq $null)
        {
            New-LogAction -Message "[PROBLEM]  Process: $proc_exe_path HASH: $hash.  Problem getting Virus Total Report"
            continue
        }
        If ($report.positives -gt 2)
        {
            Add-Content -Path $black_file -Value $hash
            New-LogAction -Message "[BLACKLIST ADD]  Process: $proc_exe_path HASH: $hash was blacklisted.  Hit Count: $($report.positives)/$($report.total)"

            #"Kill the process"
            "Stopping $proc_exe_path"
            Stop-Process -Id $proc.ProcessId 2> $kill_error
            If ($?)
            {
                Create-NotificationBallon -Message "Blacklisted process detected and killed. Process: $proc_exe_path" -Title "Process Killed"
                New-LogAction -Message "[PROCESS KILL](Success)  $proc_exe_path HASH: $hash"
            } else
            {
                New-LogAction -Message "[PROCESS KILL](Failed)  $proc_exe_path HASH: $hash  ERROR: $kill_error"
            }
        }
        else
        {
            Add-Content -Path $white_file -Value $hash
            New-LogAction -Message "[WHITELIST ADD]  Process: $proc_exe_path HASH: $hash was whitelisted.  Hit Count: $($report.positives)/$($report.total)"
        }
    }
}


While($true)
{
    Main
    Sleep -Seconds 1
}