{"id":13,"date":"2023-02-09T12:30:59","date_gmt":"2023-02-09T11:30:59","guid":{"rendered":"https:\/\/notbotnotes.com\/?p=13"},"modified":"2023-02-09T14:03:40","modified_gmt":"2023-02-09T13:03:40","slug":"13","status":"publish","type":"post","link":"https:\/\/notbotnotes.com\/?p=13","title":{"rendered":"They&#8217;re coming outta the walls. They&#8217;re coming outta the goddamn walls!"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">SSH Server on Windows&#8230; so no fail2ban&#8230; how could i block all brute-forced attacks without installing crapware?<br>Answer: Powershell Script to the rescue!<br><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Analyze sshd log file<\/li>\n\n\n\n<li>Search for &#8220;failed&#8221; string records<\/li>\n\n\n\n<li>Extract Source IP<\/li>\n\n\n\n<li>Create a Windows Firewall Rule to block access to Source IP<\/li>\n\n\n\n<li>Find some info about Source IP with ip-api.com webservice<\/li>\n\n\n\n<li>Log all actions made to file<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">That&#8217;s all ! Script below<br>&#x2764;&#xfe0f;&#x1f44c;<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro cbp-has-line-numbers cbp-blur-enabled cbp-unblur-on-hover\" style=\"font-size:.875rem;--cbp-line-number-color:#d8dee9ff;--cbp-line-number-width:15.382073402404785px;--cbp-line-highlight-color:rgba(201, 218, 248, 0.2);line-height:1.25rem\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#2e3440ff\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" data-code=\"$file = &quot;C:\\ProgramData\\ssh\\logs\\sshd.log&quot;\n$records_log = &quot;300&quot;\n$stringa = &quot;Failed password for invalid user&quot;\n$log = &quot;C:\\utils\\blocked_ip_ssh.log&quot;\n$failed_access_count = &quot;5&quot;\n\n\n$failed_access = get-content $file -Tail $records_log | select-string $stringa\n\n$failed_access_list = @()\n\nforeach ($line in $failed_access) { #$line = $failed_access | select -first 1\n\n    $obj = New-Object -TypeName PSObject\n    $obj | Add-Member -Type NoteProperty -Name DataOra -Value $(get-date (($line.line).split(&quot; &quot;)[1] + &quot; &quot; + ($line.line).split(&quot; &quot;)[2]))\n    $obj | Add-Member -Type NoteProperty -Name User -Value ($line.line).split(&quot; &quot;)[8]\n    $obj | Add-Member -Type NoteProperty -Name IP -Value ($line.line).split(&quot; &quot;)[10]\n    $obj | Add-Member -Type NoteProperty -Name Porta -Value ($line.line).split(&quot; &quot;)[12]\n            \n    $failed_access_list += $obj\n \n}\n\n\n$existing_rules = (get-netfirewallrule | where displayname -match &quot;Block_ip_&quot;).displayname \n\nforeach ( $record in  ($failed_access_list | Group-Object -Property IP | where count -gt $failed_access_count) ) {\n\n    $datetime = $(get-date).tostring(&quot;yyyyMMddHHmmss&quot;)\n    $rulename = \u201cBlock_ip_$($record.name)\u201d\n\n    if ($null -eq ($existing_rules | where {$_ -match $rulename}) ) {\n\n        New-NetFirewallRule -DisplayName $($rulename + &quot;_&quot; + $datetime) -Profile Public \u2013RemoteAddress $record.name -Direction Inbound -Action Block\n \n        $rule = get-netfirewallrule -DisplayName \u201cBlock_ip_$($record.name)_$datetime\u201d\n\n        if ($null -ne $rule) {\n\n             $api_geolocation = Invoke-WebRequest &quot;http:\/\/ip-api.com\/json\/$($record.name)?fields=status,message,continent,continentCode,country,countryCode,region,regionName,city,district,zip,lat,lon,timezone,offset,currency,isp,org,as,asname,reverse,mobile,proxy,hosting,query&quot;\n    \n             Start-Sleep -Seconds 2\n        \n            &quot;$(get-date -format yyyyMMddHHmmss) bloccato ip $($record.name) ($(($api_geolocation.Content | convertfrom-json).country) - $(($api_geolocation.Content | convertfrom-json).regionname) - $(($api_geolocation.Content | convertfrom-json).city) - $( ($api_geolocation.Content | convertfrom-json).isp) - $( ($api_geolocation.Content | convertfrom-json).org) - $( ($api_geolocation.Content | convertfrom-json).as)) con regola firewall 'Block_ip_$($record.name)_$datetime'&quot; | add-content $log\n\n        }\n\n    }\n   \n\n}\" style=\"color:#d8dee9ff;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki nord\" style=\"background-color: #2e3440ff\"><code><span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">file<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">C:\\ProgramData\\ssh\\logs\\sshd.log<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">records_log<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">300<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">stringa<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">Failed password for invalid user<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">log<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">C:\\utils\\blocked_ip_ssh.log<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">failed_access_count<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">5<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">failed_access<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">get-content<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">file<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Tail <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">records_log<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">select-string<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">stringa<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">failed_access_list<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">@<\/span><span style=\"color: #ECEFF4\">()<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">foreach<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">line<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">in<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">failed_access<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">{<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #616E88\">#$line = $failed_access | select -first 1<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">obj<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">New-Object<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">TypeName PSObject<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">obj<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">Add-Member<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Type NoteProperty <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name DataOra <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #88C0D0\">get-date<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">((<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">line.line<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\">.split<\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">)[<\/span><span style=\"color: #B48EAD\">1<\/span><span style=\"color: #ECEFF4\">]<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">+<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">+<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">line.line<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\">.split<\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">)[<\/span><span style=\"color: #B48EAD\">2<\/span><span style=\"color: #ECEFF4\">]))<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">obj<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">Add-Member<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Type NoteProperty <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name User <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">line.line<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\">.split<\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">)[<\/span><span style=\"color: #B48EAD\">8<\/span><span style=\"color: #ECEFF4\">]<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">obj<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">Add-Member<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Type NoteProperty <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name IP <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">line.line<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\">.split<\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">)[<\/span><span style=\"color: #B48EAD\">10<\/span><span style=\"color: #ECEFF4\">]<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">obj<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">Add-Member<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Type NoteProperty <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Name Porta <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Value <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">line.line<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\">.split<\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">)[<\/span><span style=\"color: #B48EAD\">12<\/span><span style=\"color: #ECEFF4\">]<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">            <\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">failed_access_list<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">+=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">obj<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\"> <\/span><\/span>\n<span class=\"line\"><span style=\"color: #ECEFF4\">}<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">existing_rules<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #88C0D0\">get-netfirewallrule<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">where<\/span><span style=\"color: #D8DEE9FF\"> displayname <\/span><span style=\"color: #81A1C1\">-match<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">Block_ip_<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\">.displayname <\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #81A1C1\">foreach<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">record<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">in<\/span><span style=\"color: #D8DEE9FF\">  <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">failed_access_list<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">Group-Object<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Property IP <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">where<\/span><span style=\"color: #D8DEE9FF\"> count <\/span><span style=\"color: #81A1C1\">-gt<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">failed_access_count<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">{<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">datetime<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #88C0D0\">get-date<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\">.tostring<\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">yyyyMMddHHmmss<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">rulename<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">\u201c<\/span><span style=\"color: #A3BE8C\">Block_ip_<\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">record.name<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #ECEFF4\">\u201d<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #81A1C1\">if<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$null<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-eq<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">existing_rules<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">where<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">{<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9FF\">_ <\/span><span style=\"color: #81A1C1\">-match<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">rulename<\/span><span style=\"color: #ECEFF4\">})<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">{<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #88C0D0\">New-NetFirewallRule<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">DisplayName <\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">rulename<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">+<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">_<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">+<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">datetime<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Profile Public \u2013RemoteAddress <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">record.name<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Direction Inbound <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Action Block<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\"> <\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">rule<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">get-netfirewallrule<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">DisplayName <\/span><span style=\"color: #ECEFF4\">\u201c<\/span><span style=\"color: #A3BE8C\">Block_ip_<\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">record.name<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">_<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">datetime<\/span><span style=\"color: #ECEFF4\">\u201d<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #81A1C1\">if<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$null<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-ne<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">rule<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">{<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">             <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">api_geolocation<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">=<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">Invoke-WebRequest<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #A3BE8C\">http:\/\/ip-api.com\/json\/<\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">record.name<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">?fields=status,message,continent,continentCode,country,countryCode,region,regionName,city,district,zip,lat,lon,timezone,offset,currency,isp,org,as,asname,reverse,mobile,proxy,hosting,query<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">             <\/span><span style=\"color: #88C0D0\">Start-Sleep<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #D8DEE9FF\">Seconds <\/span><span style=\"color: #B48EAD\">2<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">            <\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #88C0D0\">get-date<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #81A1C1\">-<\/span><span style=\"color: #A3BE8C\">format yyyyMMddHHmmss<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\"> bloccato ip <\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">record.name<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\"> (<\/span><span style=\"color: #ECEFF4\">$((<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">api_geolocation.Content<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #88C0D0\">convertfrom-json<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">.country<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\"> - <\/span><span style=\"color: #ECEFF4\">$((<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">api_geolocation.Content<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #88C0D0\">convertfrom-json<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">.regionname<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\"> - <\/span><span style=\"color: #ECEFF4\">$((<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">api_geolocation.Content<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #88C0D0\">convertfrom-json<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">.city<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\"> - <\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">api_geolocation.Content<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #88C0D0\">convertfrom-json<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">.isp<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\"> - <\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">api_geolocation.Content<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #88C0D0\">convertfrom-json<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">.org<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\"> - <\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #ECEFF4\">(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">api_geolocation.Content<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #A3BE8C\"> <\/span><span style=\"color: #88C0D0\">convertfrom-json<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">.as<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">) con regola firewall &#39;Block_ip_<\/span><span style=\"color: #ECEFF4\">$(<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">record.name<\/span><span style=\"color: #ECEFF4\">)<\/span><span style=\"color: #A3BE8C\">_<\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">datetime<\/span><span style=\"color: #A3BE8C\">&#39;<\/span><span style=\"color: #ECEFF4\">&quot;<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">|<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #88C0D0\">add-content<\/span><span style=\"color: #D8DEE9FF\"> <\/span><span style=\"color: #81A1C1\">$<\/span><span style=\"color: #D8DEE9\">log<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">        <\/span><span style=\"color: #ECEFF4\">}<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">    <\/span><span style=\"color: #ECEFF4\">}<\/span><\/span>\n<span class=\"line\"><span style=\"color: #D8DEE9FF\">   <\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color: #ECEFF4\">}<\/span><\/span><\/code><\/pre><\/div>\n","protected":false},"excerpt":{"rendered":"<p>SSH Server on Windows&#8230; so no fail2ban&#8230; how could i block all brute-forced attacks without installing crapware?Answer: Powershell Script to the rescue! That&#8217;s all ! Script below&#x2764;&#xfe0f;&#x1f44c;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"advanced_seo_description":"","jetpack_seo_html_title":"","jetpack_seo_noindex":false,"jetpack_seo_schema_type":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[6],"tags":[3,5,4],"class_list":["post-13","post","type-post","status-publish","format-standard","hentry","category-script","tag-powershell","tag-script","tag-security"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack-related-posts":[],"jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/notbotnotes.com\/index.php?rest_route=\/wp\/v2\/posts\/13","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/notbotnotes.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/notbotnotes.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/notbotnotes.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/notbotnotes.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=13"}],"version-history":[{"count":5,"href":"https:\/\/notbotnotes.com\/index.php?rest_route=\/wp\/v2\/posts\/13\/revisions"}],"predecessor-version":[{"id":38,"href":"https:\/\/notbotnotes.com\/index.php?rest_route=\/wp\/v2\/posts\/13\/revisions\/38"}],"wp:attachment":[{"href":"https:\/\/notbotnotes.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=13"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/notbotnotes.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=13"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/notbotnotes.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=13"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}