Updates

Initial-DACheck.cna

@@ -3,13 +3,6 @@ sub powerview {
   bpowershell_import($1, script_resource("Invoke-DACheck.ps1"));
 }
 
-popup beacon {
-  # menu definitions above this point
-  insert_menu("view", $1);
-  
-  # menu definitions below this point
-}
-
 alias checkda {
   powerview($1);
   bpowershell($1, 'Invoke-DACheck');
@@ -24,15 +17,15 @@ beacon_command_register(
 # set up the Initial check
 on beacon_initial {
   powerview($1);
-  bpowershell($1, 'Invoke-DACheck');
+  bpowershell($1, 'Invoke-DACheck -Initial True');
 }
 
 # set up event consumer to search for specfic pattern
 # if found alert them via Elog and box
 on beacon_output {
     $s = replace($2, 'received output:\n'.'');
-    println($s);
-    $f = "Found-DA-User:";
+    # println($s);
+    $f = "[!] Found-DA-User:";
     if ($f isin $s)
       {
       $pid = binfo($1, "pid");

Invoke-DACheck.ps1

@@ -2,11 +2,15 @@ function Invoke-DACheck {
 <#
         .SYNOPSIS
         Checks to see if current user is in DA Groups and if he is returns a specfic string alerting user that they are DA for Automated purposes.
+
+        .PARAMETER Initial
+        Enables a share Anyone can Read/Write to.
     #>
-    [CmdletBinding()]
+    [cmdletbinding()]
     param(
-        [Parameter(ValueFromPipeline=$True)]
-        [string]$Command
+        [Parameter(Position=0,ValueFromPipeline=$true)]
+        [String[]]
+        $Initial
     )
     process {
         $User = Get-User
@@ -15,11 +19,16 @@ function Invoke-DACheck {
             {
             if($User -eq $DomainUser)
                 {
-                Write-Host "Found-DA-User: $User"
+                If($Initial)
+                    {
+                    Write-Host "[!] Found-DA-User: $User"
+                    }
+                Else
+                    {
+                    Write-Host "[!] Currently DA Context"
+                    }
                 }
-
-
-            }
+        }
     }
 }
 
@@ -59,7 +68,7 @@ function Get-DomainAdmins {
             $DAUsers = foreach($x in $group.GetMembers($Recurse)){$x.SamAccountName}
             return $DAUsers
             }
-    }
+        }
     }