Caldera emulation abilities

[{"platform": "windows", "executor": "psh", "command": "if (Test-Path C:\\Users\\Public\\malicious_files.txt -PathType Leaf) {\n  $hashes = Get-Content C:\\Users\\Public\\malicious_files.txt -Raw;\n  Remove-Item C:\\Users\\Public\\malicious_files.txt;\n  $hashes;\n}\n"}]

[{"platform": "windows", "executor": "psh, pwsh", "command": "function getFullList($portList){\n    $final = @();\n    foreach ($p in $portList) {\n        if ($p -like \"*-*\") {\n            $minmax = $p.Split(\"-\");\n            for ($i = ($minmax[0] -as [int]); $i -lt ($minmax[1] -as [int]); $i++) {\n                $final += ($i -as [string]);\n            };\n        } else {\n            $final += $p;\n        };\n    };\n    return $final;\n};\n$basePorts = @(\"135\",\"139\",\"389\",\"445\",\"636\",\"1000-5000\",\"9389\",\"49152-65535\");\n$allPorts = getFullList $basePorts;\n$pidToPort = @();\nforeach ($port in (Get-NetTCPConnection -RemoteAddress 0.0.0.0 -state Listen)){\n    if ($allPorts -notcontains $port.LocalPort){\n        $pidToPort += , @{pid=$port.OwningProcess;port=$port.LocalPort};\n    }\n};\n$pidToPort | ConvertTo-Json;\n"}]

[{"platform": "darwin", "executor": "sh", "command": "ps aux | grep -v grep | grep #{remote.port.unauthorized} | awk '{print $2}'\n"}, {"platform": "linux", "executor": "sh", "command": "ps aux | grep -v grep | grep #{remote.port.unauthorized} | awk '{print $2}'\n"}, {"platform": "windows", "executor": "psh,pwsh", "command": "Get-NetTCPConnection -RemotePort \"#{remote.port.unauthorized}\" -EA silentlycontinue | where-object { write-host $_.OwningProcess }\n"}]

[{"platform": "linux", "executor": "sh", "command": "directory=\"#{directory.sensitive.path}\";\nif [ -d $directory ];\n  then tar -czf /tmp/dir_sens_comp -C $directory .;\n  hash=$(sha256sum /tmp/dir_sens_comp | cut -d' ' -f1);\n  rm -f /tmp/dir_sens_comp;\n  if [ \"$hash\" != \"#{directory.sensitive.hash}\" ];\n    then echo $directory;\n  fi;\nelse echo $directory;\nfi;\n"}, {"platform": "darwin", "executor": "sh", "command": "directory=\"#{directory.sensitive.path}\";\nif [ -d $directory ];\n  then tar -cf - -C $directory . | gzip --no-name > /tmp/dir_sens_comp;\n  hash=$(shasum -a 256 /tmp/dir_sens_comp | cut -d' ' -f1);\n  rm -f /tmp/dir_sens_comp;\n  if [ \"$hash\" != \"#{directory.sensitive.hash}\" ];\n    then echo $directory;\n  fi;\nelse echo $directory;\nfi;\n"}, {"platform": "windows", "executor": "psh", "command": "$directory = \"#{directory.sensitive.path}\";\nif (Test-Path -PathType Container $directory) {\n  Compress-Archive -Force -Path $($directory + \"\\*\") -DestinationPath C:\\Users\\Public\\dir_sens_comp.zip;\n  $hash = (Get-FileHash C:\\Users\\Public\\dir_sens_comp.zip).Hash;\n  Remove-Item -Force C:\\Users\\Public\\dir_sens_comp.zip;\n  if ($hash -ne \"#{directory.sensitive.hash}\") {\n    echo $directory;\n  }\n} else {\n  echo $directory;\n}\n"}]

[{"platform": "linux", "executor": "sh", "command": "filepath=\"#{file.sensitive.path}\";\nif [ ! -f $filepath ] || [ \"$(sha256sum $filepath | cut -d' ' -f1)\" != \"#{file.sensitive.hash}\" ];\n  then echo $filepath;\nfi\n"}, {"platform": "darwin", "executor": "sh", "command": "filepath=\"#{file.sensitive.path}\";\nif [ ! -f $filepath ] || [ \"$(shasum -a 256 $filepath | cut -d' ' -f1)\" != \"#{file.sensitive.hash}\" ];\n  then echo $filepath;\nfi\n"}, {"platform": "windows", "executor": "psh", "command": "if (-not (Test-Path -PathType Leaf #{file.sensitive.path}) -or (Get-FileHash #{file.sensitive.path}).Hash -ne \"#{file.sensitive.hash}\") { echo #{file.sensitive.path} }\n"}]

[{"platform": "linux", "executor": "sh", "command": "set -f;\nfor user in $(getent passwd | cut -f1 -d:); do\n  $(crontab -u $user -l 2>/dev/null | grep -v '\\#' | while read -r job; do\n    echo \"${user}>${job}\" >> /tmp/cron_jobs;\n  done);\ndone;\ncat /tmp/cron_jobs | sort > /tmp/new_cronjobs_list.txt;\nnew_jobs=$(comm -13 /tmp/baseline_cronjobs_list.txt /tmp/new_cronjobs_list.txt);\nrm -f /tmp/cron_jobs;\nrm -f /tmp/new_cronjobs_list.txt;\nIFS=$(echo '\\n');\necho $new_jobs;\n"}, {"platform": "darwin", "executor": "sh", "command": "set -f;\nfor user in $(dscl . list /Users | grep -v \"^_\"); do\n  $(crontab -u $user -l 2>/dev/null | grep -v '\\#' | while read -r job; do\n    echo \"${user}>${job}\" >> /tmp/cron_jobs;\n  done);\ndone;\ncat /tmp/cron_jobs | sort > /tmp/new_cronjobs_list.txt;\nnew_jobs=$(comm -13 /tmp/baseline_cronjobs_list.txt /tmp/new_cronjobs_list.txt);\nrm -f /tmp/cron_jobs;\nrm -f /tmp/new_cronjobs_list.txt;\nIFS=$(echo '\\n');\necho $new_jobs;\n"}]

[{"platform": "windows", "executor": "psh", "command": "Get-ScheduledTask > C:\\Users\\Public\\new_schtasks_list.txt;\n$new_schtasks =  $(Get-Content .\\new_schtasks_list.txt) | Where-Object {$_ -notIn $(Get-Content .\\baseline_schtasks_list.txt)} |foreach-object {(-split $_)[1]};\nRemove-Item -Path C:\\Users\\Public\\new_schtasks_list.txt -Force;\n$new_schtasks\n"}]

[{"platform": "linux", "executor": "sh", "command": "find /var/mail -type f -exec grep \"From.*@.*\\..*\" {} \\; | cut -d'@' -f2 | cut -d' ' -f1 | sort --uniq\n"}, {"platform": "darwin", "executor": "sh", "command": "find /var/mail -type f -exec grep \"From.*@.*\\..*\" {} \\; | cut -d'@' -f2 | cut -d' ' -f1 | sort --uniq\n"}]