Check for CanaryTokens in Microsoft Office Files

coalmine.ps1

#
# Name: coalmine.ps1
# Author: C0axx
# Check-Docx -docxPath .\gwfrr71nre79bk5gokt3h96ms.docx
# Check-Xlsx -xlsxPath .\o25p0hk0p6ss0gmnn9e7rdxh5.xlsx
# Check-PDF -PDfPath .\wjsmq251q2b8dmnu0022m0i5q.pdf

function Check-Docx () {
    [CmdletBinding()] Param(
              [Parameter(Mandatory=$True)] [String] $docxPath,
              [String] $tempPath = "C:\Users\Curtis\Desktop\Temp\"
        )
Copy-Item -Path $docxPath -Destination $tempPath/Doc.zip -ErrorAction SilentlyContinue
Expand-Archive -Path $tempPath/Doc.zip -DestinationPath $tempPath/TempDoc -ErrorAction SilentlyContinue

$DocxFiles = Get-ChildItem -Path $tempPath/TempDoc -Filter *.xml -Recurse -ErrorAction SilentlyContinue -Force

$canaryFound = $false
$regex = ‘([a-zA-Z]{3,})://(.+\.)?canarytokens\.com+(/[\w- ./?%&=]*)|([a-zA-Z]{3,})://internalcanarytokendomain\.org+(/[\w- ./?%&=]*)’

$DocxFiles | foreach {
	IF ($_.FullName -match "footer" -or $_.FullName -match "header") {
		IF ($match = Select-String -Path $_.FullName -Pattern $regex  -AllMatches ) { Write-Host 
			$match |Select-String -Pattern 'canarytoken'| % { $_.Matches } | % { $_.Value } }}
	}
Remove-Item -Path $tempPath/Doc.zip -Force
Remove-Item -Path $tempPath/TempDoc -Recurse -Force
}

function Check-Xlsx () {
    [CmdletBinding()] Param(
              [Parameter(Mandatory=$True)] [String] $xlsxPath,
              [String] $tempPath = $env:TEMP
        )
Copy-Item -Path $xlsxPath -Destination $tempPath/Xlsx.zip -ErrorAction SilentlyContinue
Expand-Archive -Path $tempPath/Xlsx.zip -DestinationPath $tempPath/TempXlsx -ErrorAction SilentlyContinue

$XlsxFiles = Get-ChildItem -Path $tempPath/TempXlsx -Filter *.xml.rels -Recurse -ErrorAction SilentlyContinue -Force
$regex = ‘([a-zA-Z]{3,})://(.+\.)?canarytokens\.com+(/[\w- ./?%&=]*)|([a-zA-Z]{3,})://internalcanarytokendomain\.org+(/[\w- ./?%&=]*)’

$XlsxFiles | foreach {
		IF ($match = Select-String -Path $_.FullName -Pattern $regex  -AllMatches ) { Write-Host 
			$match |Select-String -Pattern 'canarytoken'| % { $_.Matches } | % { $_.Value } }}
Remove-Item -Path $tempPath/Xlsx.zip -Force
Remove-Item -Path $tempPath/TempXlsx -Recurse -Force
	}

function Check-PDF () {
    [CmdletBinding()] Param(
              [Parameter(Mandatory=$True)] [String] $PDfPath,
              [String] $tempPath = $env:TEMP
        )
Copy-Item -Path $PDfPath -Destination $tempPath/temp.pdf -ErrorAction SilentlyContinue
New-Item -Path "$tempPath/Streams" -ItemType Directory | Out-Null
& C:\PDFStreamDumper\PDFStreamDumper.exe $tempPath/temp.pdf /extract "$tempPath/Streams/"
Sleep 2
$output = Get-ChildItem -Path $tempPath/Streams -Filter *.unk -Recurse -ErrorAction SilentlyContinue -Force | Get-Content -Delimiter '(' |Select-String -Pattern canarytoken -AllMatches
$OFS = "`r"
$OFS
$output.Line

Remove-Item -Path $tempPath/temp.pdf -Force
Remove-Item -Path $tempPath/Streams -Recurse -Force
}

:)