Threat Analysis Group IOC Scanner

IOC-Checker.ps1

# Checks the registry for IOCs from https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
# If not vulnerable should return "ERROR: The system was unable to find the specified registry key or value."
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig"
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig"
reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update"

# Checks the paths of IOCs from https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/
# If not vulnerable each will return false
Test-Path C:\Windows\System32\Nwsapagent.sys     
Test-Path C:\Windows\System32\helpsvc.sys        
Test-Path C:\ProgramData\USOShared\uso.bin       
Test-Path C:\ProgramData\VMware\vmnat-update.bin 
Test-Path C:\ProgramData\VirtualBox\update.bin   

# Checks unsigned IOCs sys files, if not compromised it won't display any output 
# thx to https://twitter.com/gN3mes1s/status/1354047780738772994
Get-ChildItem $env:SystemRoot\System32\*.sys | %{Get-AuthenticodeSignature $_} | Where-Object {$_.status -ne "Valid"}

Normalized system paths and added couple checks:
https://gist.github.com/VoidSec/cfe0ff5f1c47070df95e54dcf732ddd0