Redemptio.ps1

#REQUIRES -Version 2.0

<#
.SYNOPSIS
    A brief description of the function or script. This keyword can be used
    only once in each topic.
.DESCRIPTION
    A detailed description of the function or script. This keyword can be
    used only once in each topic.
.PARAMETER Name
    Specifies the file name.
.INPUTS
    None. You cannot pipe objects to Add-Extension.
.EXAMPLE
    C:\PS> extension -name "File"
    File.txt
.EXAMPLE
    C:\PS> extension -name "File"
    File.txt
.EXAMPLE
    C:\PS> extension -name "File"
    File.txt
.NOTES
    File Name      : xxxx.ps1
    Author         : J.P. Blanc ([email protected])
.LINK
    Script posted over:
    http://www.github.com/blahblahblahblah
.LINK
    Script posted over:
    http://www.github.com/blahblahblahblah
.EXAMPLE
    Example 1
.EXAMPLE
    Example 2
#>

# Need to make the file owned by root
# Need to make a couple a.xxx files, a.doc, a.jpg, aa.doc, aa.jpg
# Need to make a disclaimer within the file
# Write out log to a non-overwritten file extension - .bla or .dll

$DirPath = "C:\Users\user\Desktop\"
$FName = "Redemptio*.txt"
$FilePath = Join-Path -Path $Dirpath -ChildPath $FName

function DriveUnMapper {
# Add function to find all NetworkDrives
    $MappedDrives = "Z", "M"
    ForEach($Drive in $MappedDrives) {
        Remove=PSDrive $Drive
        }
}

function CreateWatcher {
    $global:FSWatcherObj = New-Object IO.FileSystemWatcher $DirPath, $FName -Property @{
        IncludeSubdirectories = $false;
        EnableRaisingEvents = $true;
        NotifyFilter = [IO.NotifyFilters]'LastWrite'
    }
}

function RegisterWatcher {
    Register-ObjectEvent $FSWatcherObj Changed -SourceIdentifier FileChanged -Action { 
        $name = $Event.SourceEventArgs.Name 
        $changeType = $Event.SourceEventArgs.ChangeType 
        $timeStamp = $Event.TimeGenerated 
        Write-Host "The file '$name' was $changeType at $timeStamp" -fore red 
        $logdata = "$(Get-Date), $changeType, $FilePath, was altered!  Disconnecting Drives"
        Add-content "C:\Users\user\Desktop\Redemptio.bla" -value $logdata
        DriveUnMapper
    } 
}


#function Output-Print {
#    Write-Output "Line reads the following:  " $dafile
#}

function CreateCanary {
    New-Item C:\Users\user\Desktop\Redemptio-test.txt -ItemType File -value "Redemptio canary file"
}

#function Canary-Check {
#    $dafile = (Get-Content C:\Users\user\Desktop\Redemptio-test.txt)[0]
#}

#function Receive-Output {
#    process { Write-Host $_ -foreground Green}
#}

CreateCanary
CreateWatcher
RegisterWatcher
# Unregister-Event FileChanged

#CreateCanary
#Canary-Check
#Output-Print | Receive-Output
#Select-String C:\Users\user\Desktop\*.txt -pattern "Redemptio" | Format-List