Untitled

<#
Run_Loki.ps1
-----------------------------------------
Purpose:
- Creates C:\CA_SCAN_TEMP\
- Adds Defender exclusion
- Copies loki.zip from \\192.168.1.102\CA_Shared\KAPE_LOKI_CA\Loki\loki.zip
- Extracts it
- Runs loki.exe with CSV output redirected to a central share
- Saves results as \\192.168.1.102\CA_Result\<IP>.csv
-----------------------------------------
#>

# --- Configuration ---
$TempPath    = "C:\CA_SCAN_TEMP"
$ZipSource   = "\\192.168.1.102\KAPE_LOKI_CA\Loki\loki.zip" # Change the IP here
$ResultShare = "\\192.168.1.102\CA_Result" # Change the IP here
$ZipDest     = Join-Path $TempPath "loki.zip"

Write-Host "===== Starting Loki Deployment ====="
Write-Host "Source: $ZipSource"
Write-Host "Temp:   $TempPath"
Write-Host "Result: $ResultShare"
Write-Host ""

# 1) Create local temp folder
try {
    if (!(Test-Path $TempPath)) {
        New-Item -Path $TempPath -ItemType Directory -Force | Out-Null
        Write-Host "[+] Created folder $TempPath"
    } else {
        Write-Host "[=] Folder $TempPath already exists"
    }
} catch {
    Write-Warning "[-] Failed to create folder $TempPath : $($_.Exception.Message)"
    exit 1
}

# 2) Add Defender exclusion (ignore if Defender not present)
try {
    Add-MpPreference -ExclusionPath $TempPath -ErrorAction Stop
    Write-Host "[+] Added Defender exclusion for $TempPath"
} catch {
    Write-Warning "[!] Defender exclusion failed or Defender not present: $($_.Exception.Message)"
}

# 3) Copy LOKI zip from share
if (Test-Path $ZipSource) {
    try {
        Copy-Item $ZipSource $ZipDest -Force
        Write-Host "[+] Copied loki.zip from $ZipSource"
    } catch {
        Write-Warning "[-] Failed to copy $ZipSource. Verify share access and permissions."
        exit 1
    }
} else {
    Write-Warning "[-] Source file $ZipSource not found. Verify share and permissions."
    exit 1
}

# 4) Extract the ZIP
try {
    Expand-Archive -Path $ZipDest -DestinationPath $TempPath -Force
    Write-Host "[+] Extracted loki.zip"
} catch {
    Write-Warning "[-] Failed to extract loki.zip: $($_.Exception.Message)"
    exit 1
}

# 5) Determine machine primary IPv4 (best-effort)
$MyIP = (
    Get-NetIPAddress -AddressFamily IPv4 |
    Where-Object { $_.IPAddress -notmatch '^127\.' -and $_.IPAddress -ne '0.0.0.0' -and $_.PrefixLength -lt 33 } |
    Sort-Object InterfaceMetric,SkipAsSource |
    Select-Object -First 1 -ExpandProperty IPAddress
)
if (-not $MyIP) { $MyIP = $env:COMPUTERNAME }  # fallback

$ResultCsv = Join-Path $ResultShare "$MyIP.csv"

# 6) Locate LOKI executable
$ExePath = Join-Path $TempPath "loki.exe"
if (!(Test-Path $ExePath)) {
    $found = Get-ChildItem -Path $TempPath -Recurse -Filter "loki.exe" -ErrorAction SilentlyContinue | Select-Object -First 1
    if ($found) { $ExePath = $found.FullName }
}
if (!(Test-Path $ExePath)) {
    Write-Warning "[-] loki.exe not found after extraction under $TempPath."
    exit 1
}

# 7) Verify share write access
try {
    $testFile = Join-Path $ResultShare "._test_$([guid]::NewGuid()).tmp"
    "ping" | Out-File $testFile -Encoding ascii -Force
    Remove-Item $testFile -Force
    $CanWriteShare = $true
} catch {
    $CanWriteShare = $false
    Write-Warning "[!] Cannot write to $ResultShare. Will save locally and copy later."
}

# 8) Run LOKI with direct STDOUT redirection (no cmd.exe)
Write-Host "[=] Running LOKI scan on $env:COMPUTERNAME ($MyIP)..."

$StdErr = Join-Path $TempPath "loki_stderr.txt"
$LocalCsv = Join-Path $TempPath "$MyIP.csv"

$TargetCsv = if ($CanWriteShare) { $ResultCsv } else { $LocalCsv }

$psi = @{
  FilePath               = $ExePath
  ArgumentList           = @(
    "--noprocscan",
    "--noindicator",
    "--allhds",
    "--intense",
    "--csv",                 # write CSV to STDOUT
    "--logfolder", $TempPath # keep logs
  )
  WorkingDirectory        = $TempPath
  RedirectStandardOutput  = $TargetCsv
  RedirectStandardError   = $StdErr
  NoNewWindow             = $true
  Wait                    = $true
}

try {
    Start-Process @psi
    Write-Host "[+] LOKI completed execution."
} catch {
    Write-Warning "[-] LOKI execution failed: $($_.Exception.Message)"
    if (Test-Path $StdErr) {
        Write-Warning "[i] Loki stderr output:"
        Get-Content $StdErr | Write-Warning
    }
    exit 1
}

# 9) If saved locally, copy results to share
if (-not $CanWriteShare) {
    try {
        Copy-Item $LocalCsv $ResultCsv -Force
        Write-Host "[+] Copied local CSV to $ResultCsv"
    } catch {
        Write-Warning "[!] Could not copy $LocalCsv to $ResultCsv: $($_.Exception.Message)"
    }
}

Write-Host "[✓] Results saved to: $ResultCsv"
Write-Host "===== Loki Deployment Finished ====="