ratscan.ps1

[CmdletBinding()]
param (
    [Parameter()]
    [switch]$IDPS,

    [Parameter()]
    [switch]$ThreatIntel,

    [Parameter()]
    [switch]$WebCategories,

    [Parameter()]
    [string]$Article
)

$logo = '   
                                         ╓╓╓╖╖╖╖╖╓╓╓┌                              
         └└ ╙╙╙╩╦╖╖┌                 ╒╓╬╬╬╬╬╫╬╬╬╬╬╬╬╬╬╬╬╬╦╥╥╖╬╬╬╖                   
                   └╙╙┬╦╖╓╓┌┌  ╓╓╓╓╦╦╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╫╬╜╬╬╬╖                
                          └└╙╙╙╙╙└└   ╟╬╬╬╬╬╫╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╖             
                                      ╬╙╨╨╩╬╬╬╬╩╩╬╬╬╬╬╬╬╬╬╬╬╬╬╬╬╩╩╨╬╨╩╙
                                       ╙╙└          ╙╘┘      └╙╙╙╙
'

Clear-Host
Write-Host $logo -ForegroundColor Green
Write-Output ""
Write-Output "           -- L E T S   S T A R T   R A T T I N G --"
Write-Output ""
$endPoints = @()
$threatIndicators = @()

if ($ThreatIntel) {
    Write-Host "[+] Starting Threat Intelligence tests" -ForegroundColor Green
    Write-Host "    [-] Collecting Public Threat Indicators" -ForegroundColor Green
    
    if ($Article) {
        $threatIndicators = (Invoke-RestMethod -UseBasicParsing -Uri "https://ti.defender.microsoft.com/api/articles/download/$Article") | ConvertFrom-Csv
    } else {
        $articles = (Invoke-RestMethod -UseBasicParsing -Uri "https://ti.defender.microsoft.com/api/articles/").result.count
        $threatIndicators = (Invoke-RestMethod -UseBasicParsing -Uri "https://ti.defender.microsoft.com/api/articles/").result.communityIndicators
    }
    
    $types = @('url')

    Write-Host "    [-] Preparing endpoint validation" -ForegroundColor Green
    if (-not($Article)){ 
        foreach ($ti in $threatIndicators) {
            foreach ($type in $types) {
                $endpoints += ($ti | Where-Object type -in $type).values
            }
        }
    }else {
        $endpoints = ($threatIndicators | Where-Object type -in $types).value
    }

    Write-Host "    [-] Querying vulnerable endpoints" -ForegroundColor Green
    foreach ($endpoint in $endPoints) {
        if ($endpoint) {
            try {
                Write-Host "        [-] $endpoint" -ForegroundColor Green
                $null = Invoke-WebRequest -Uri $endpoint -TimeoutSec 15
            }
            catch {
                Write-Information "    [-] Endpoint not available"
            }
        }
    }
} 

if ($IDPS) {
    Write-Host "[+] Starting IDPS tests" -ForegroundColor Green
    $userAgents = @('Mozilla/5.0', 'Mozilla/3.0', 'HaxerMen', 'InternetExplorer')
    foreach ($userAgent in $userAgents) {
        Write-Host "    [-] using Agent [$($userAgent)]...`r" -ForegroundColor Green
        $null = Invoke-RestMethod -Uri http://neverssl.com -UserAgent $userAgent
        $null = Invoke-RestMethod -Uri http://neverssl.com -UserAgent $userAgent
        $null = Invoke-RestMethod -Uri http://nedscaper.com -UserAgent $userAgent
    }
    Write-Host
    Write-Host "All done! Check your SIEM for alerts using the timestamps [$(Get-Date)]" -ForegroundColor Green
    Write-Host
}

Ratscan

Use this tool to test the detection of your (Azure) Firewall.