AndrewRathbun / DFIRPowerShellScripts

Various PowerShells scripts I've made (or others have made) to automate some of the boring stuff in my everyday DFIR journey!
MIT License
44 stars 15 forks source link

Get-ChainsawSigmaRules.ps1 Invoke-WebRequest #3

Closed Beercow closed 1 year ago

Beercow commented 1 year ago

I am having the following issue where Get-ChainsawSigmaRules.ps1 Could not create SSL/TLS secure channel.

[2023-04-10 08:57:26.1158033 | INF] Running C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe: & 'F:\KAPE_UPDATE\Modules\bin\Get-ChainsawSigmaRules.ps1' [2023-04-10 08:57:26.5689588 | ERR] Invoke-WebRequest : The request was aborted: Could not create SSL/TLS secure channel. [2023-04-10 08:57:26.5689588 | ERR] At F:\KAPE_UPDATE\Modules\bin\Get-ChainsawSigmaRules.ps1:38 char:5 [2023-04-10 08:57:26.5689588 | ERR] + Invoke-WebRequest -Uri $sigmaRulesGitHubUrl -OutFile $sigmaRulesG ... [2023-04-10 08:57:26.5689588 | ERR] + ~~~~~~~~~~~~~ [2023-04-10 08:57:26.5689588 | ERR] + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-WebRequest], WebExc [2023-04-10 08:57:26.5845827 | ERR] eption [2023-04-10 08:57:26.5845827 | ERR] + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand [2023-04-10 08:57:26.5845827 | ERR]
[2023-04-10 08:57:29.8191733 | ERR] Expand-Archive : The path 'F:\KAPE_UPDATE\Modules\bin\sigma-master.zip' either does not exist or is not a valid file [2023-04-10 08:57:29.8191733 | ERR] system path. [2023-04-10 08:57:29.8191733 | ERR] At F:\KAPE_UPDATE\Modules\bin\Get-ChainsawSigmaRules.ps1:52 char:5 [2023-04-10 08:57:29.8348047 | ERR] + Expand-Archive -Path "$sigmaRulesGitHubZip" -DestinationPath "$PS ... [2023-04-10 08:57:29.8348047 | ERR] + ~~~~~~~~~~~~~ [2023-04-10 08:57:29.8348047 | ERR] + CategoryInfo : InvalidArgument: (F:\KAPE_UPDATE...igma-master.zip:String) [Expand-Archive], InvalidOpe [2023-04-10 08:57:29.8348047 | ERR] rationException [2023-04-10 08:57:29.8348047 | ERR] + FullyQualifiedErrorId : ArchiveCmdletPathNotFound,Expand-Archive [2023-04-10 08:57:29.8348047 | ERR]
[2023-04-10 08:57:36.1960697 | ERR] Move-Item : Cannot find path 'F:\KAPE_UPDATE\Modules\bin\sigma-master\rules' because it does not exist. [2023-04-10 08:57:36.1960697 | ERR] At F:\KAPE_UPDATE\Modules\bin\Get-ChainsawSigmaRules.ps1:79 char:5 [2023-04-10 08:57:36.1960697 | ERR] + Move-Item -Path $sigmaRulesGitHubTargetFolder -Destination $sigma ... [2023-04-10 08:57:36.1960697 | ERR] + ~~~~~~~~~~~~~ [2023-04-10 08:57:36.1960697 | ERR] + CategoryInfo : ObjectNotFound: (F:\KAPE_UPDATE...ma-master\rules:String) [Move-Item], ItemNotFoundExce [2023-04-10 08:57:36.1960697 | ERR] ption [2023-04-10 08:57:36.1960697 | ERR] + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.MoveItemCommand [2023-04-10 08:57:36.1960697 | ERR]
[2023-04-10 08:57:39.2003892 | ERR] Remove-Item : Cannot find path 'F:\KAPE_UPDATE\Modules\bin\sigma-master.zip' because it does not exist. [2023-04-10 08:57:39.2003892 | ERR] At F:\KAPE_UPDATE\Modules\bin\Get-ChainsawSigmaRules.ps1:93 char:5 [2023-04-10 08:57:39.2003892 | ERR] + Remove-Item -Path "$PSScriptRoot\sigma-master.zip" -Force [2023-04-10 08:57:39.2003892 | ERR] + ~~~~~~~~~~~~~ [2023-04-10 08:57:39.2003892 | ERR] + CategoryInfo : ObjectNotFound: (F:\KAPE_UPDATE...igma-master.zip:String) [Remove-Item], ItemNotFoundEx [2023-04-10 08:57:39.2003892 | ERR] ception [2023-04-10 08:57:39.2003892 | ERR] + FullyQualifiedErrorId : PathNotFound,Microsoft.PowerShell.Commands.RemoveItemCommand [2023-04-10 08:57:39.2003892 | ERR]

Beercow commented 1 year ago

Due to powershell defaulting to TLS1.0 image

To fix the issue, run the following connamd:

PS> [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls, [Net.SecurityProtocolType]::Tls11, [Net.SecurityProtocolType]::Tls12, [Net.SecurityProtocolType]::Ssl3