Checks IIS logs for known bad IPs from Microsoft/Volexity blog post and internal IR efforts

IIS-Log-HAFNIUM-IP-Checkers.ps1

$KnownBadIPs = "103.77.192.219", "104.140.114.110", "104.250.191.110", "108.61.246.56", "149.28.14.163", "157.230.221.198", "167.99.168.251", "185.250.151.72", "192.81.208.169", "203.160.69.66", "211.56.98.146", "5.254.43.18", "80.92.205.81", "165.232.154.116", "89.34.111.11", "86.105.18.116", "112.68.212.214", "124.46.192.149", "37.147.230.142", "61.78.141.128", "212.69.1.194", "88.157.2.183", "121.153.83.248", "60.246.26.200", "210.223.169.77", "183.173.113.166", "23.240.201.239", "118.218.186.184", "77.122.10.183", "46.101.232.43", "45.157.53.13", "110.39.192.162" 

$files = Get-ChildItem -Recurse "C:\inetpub\logs\LogFiles\*.log"

foreach($file in $files) 
{ 
    Write-Host "Reading files"
    Write-Host $file.Name
    $ReadFile = Get-Content -Path $file
    foreach($BadIP in $KnownBadIPs) {
        Write-Host "Hunting for string $BadIP" -ForegroundColor Cyan
        $found = $ReadFile -Match $BadIP
        if ($found)  {
            Write-Host $found -ForegroundColor Red
            Read-Host -Prompt "Bad IP found in IIS logs. Review this event. Press enter to continue..."
        }

    }

}