{"id":353787,"date":"2024-09-11T13:59:40","date_gmt":"2024-09-11T13:59:40","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/monitorizar-las-modificaciones-de-los-archivos\/"},"modified":"2024-10-13T19:08:05","modified_gmt":"2024-10-13T19:08:05","slug":"monitorizar-las-modificaciones-de-los-archivos","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/es\/script-hub\/monitorizar-las-modificaciones-de-los-archivos\/","title":{"rendered":"C\u00f3mo monitorizar las modificaciones de los archivos y garantizar su integridad mediante PowerShell"},"content":{"rendered":"

En el mundo de la inform\u00e1tica, mantener la integridad y seguridad de los archivos es primordial. Los profesionales de TI y los proveedores de servicios gestionados (MSP)<\/a> necesitan m\u00e9todos fiables para monitorizar las modificaciones de los archivos<\/strong> con el fin de evitar cambios no autorizados, garantizar el cumplimiento y mantener la estabilidad del sistema. Este post explora un potente script PowerShell<\/a> dise\u00f1ado para comprobar si un archivo existe, determinar si se ha modificado en un plazo de tiempo especificado y verificar su integridad mediante una comprobaci\u00f3n hash.<\/p>\n

Contexto<\/h2>\n

Los profesionales de TI y los MSP se enfrentan a menudo al reto de garantizar que los archivos permanezcan inalterados a menos que el personal autorizado los modifique expl\u00edcitamente. Las modificaciones no autorizadas pueden provocar brechas de seguridad<\/a>, corrupci\u00f3n de datos y problemas de cumplimiento. Para hacer frente a estos retos, se necesita una soluci\u00f3n s\u00f3lida que controle los cambios en los archivos y garantice su integridad. Este script PowerShell para monitorizar las modificaciones de los archivos ofrece un enfoque simplificado para abordar estas necesidades, proporcionando alertas basadas en condiciones espec\u00edficas, como cambios en los archivos o la falta de ellos.<\/p>\n

El script para monitorizar las modificaciones de los archivos<\/h2>\n
<#\r\n.SYNOPSIS\r\n    Checks whether a file is present and if it has been updated within your specified time frame or fails a hash check.\r\n.DESCRIPTION\r\n    Checks whether a file is present and if it has been updated within your specified time frame or fails a hash check.\r\n\r\nPARAMETER: -Alert \"Alert If Change\" or -Alert \"Alert If No Change\"\r\n    Raise an alert if the file has or hasn't been modified based on your other parameters.\r\n\r\nPARAMETER: -Hash \"REPLACEMEC32D73431CED24FF114B2A216671C60117AF5012B40\"\r\n    The hash or checksum to verify that the file hasn't been modified.\r\nPARAMETER: -Algorithm \"SHA256\"\r\n    The hashing algorithm used for your inputted hash.\r\n.EXAMPLE\r\n    -Path \"C:\\TestFile.txt\" -Hash \"REPLACEME04C6F26CC32D73431CED24FF114B2A216671C60117AF5012B40\" -Alert \"Alert If No Change\"\r\n\r\n    C:\\TestFile.txt exists!\r\n    Hash Given: REPLACEME04C6F26CC32D73431CED24FF114B2A216671C60117AF5012B40\r\n    Current Hash: 35BAFB1CE99AEF3AB068AFBAABAE8F21FD9B9F02D3A9442E364FA92C0B3EEEF0\r\n    Hash mismatch!\r\n\r\n.EXAMPLE\r\n    -Path \"C:\\TestFile.txt\" -Hash \"35BAFB1CE99AEF3AB068AFBAABAE8F21FD9B9F02D3A9442E364FA92C0B3BEEF0\" -Alert \"Alert If No Change\"\r\n\r\n    C:\\TestFile.txt exists!\r\n    Hash Given: 35BAFB1CE99AEF3AB068AFBAABAE8F21FD9B9F02D3A9442E364FA92C0B3BEEF0\r\n    Current Hash: 35BAFB1CE99AEF3AB068AFBAABAE8F21FD9B9F02D3A9442E364FA92C0B3BEEF0\r\n    Hash matches!\r\n    [Alert] File has not been modified!\r\n\r\nPARAMETER: -Days \"REPLACEMEWITHANUMBER\"\r\n    Raise an alert if the file hasn't been modified within the specified number of days. \r\n    Minutes and Hours are added to this time.\r\n\r\nPARAMETER: -Hours \"REPLACEMEWITHANUMBER\"\r\n    Raise an alert if the file hasn't been modified within the specified number of hours. \r\n    Days and Minutes are added to this time.\r\n\r\nPARAMETER: -Minutes \"REPLACEMEWITHANUMBER\"\r\n    Raise an alert if the file hasn't been modified within the specified number of minutes. \r\n    Days and Hours are added to this time.\r\n.EXAMPLE\r\n    -Path \"C:\\TestFile.txt\" -Days 365 -Alert \"Alert If Change\"\r\n\r\n    C:\\TestFile.txt exists!\r\n    Checking if the file was modified in the last 365 day(s) 00 hour(s) 00 minute(s)\r\n    File was last modified on 02\/07\/2024 14:59:56.\r\n    File has been updated within the time period.\r\n    [Alert] File has been modified!\r\n.EXAMPLE\r\n    -Path \"C:\\TestFile.txt\" -Days 30 -Alert \"Alert If Change\"\r\n\r\n    C:\\TestFile.txt exists!\r\n    Checking if the file was modified in the last 30 day(s) 00 hour(s) 00 minute(s)\r\n    File was last modified on 05\/15\/2023 15:13:55.\r\n    File has not been modified within the time period.\r\n\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 8+, Server 2012+\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$Alert,\r\n    [Parameter()]\r\n    [String]$Path,\r\n    [Parameter()]\r\n    [String]$Hash,\r\n    [Parameter()]\r\n    [String]$Algorithm = \"SHA256\",\r\n    [Parameter()]\r\n    [int]$Days,\r\n    [Parameter()]\r\n    [int]$Hours,\r\n    [Parameter()]\r\n    [int]$Minutes\r\n)\r\n\r\nbegin {\r\n    # Replace parameters with dynamic script variables\r\n    if ($env:alert -and $env:alert -notlike \"null\") { $Alert = $env:alert }\r\n    if ($env:targetFilePath -and $env:targetFilePath -notlike \"null\") { $Path = $env:targetFilePath }\r\n    if ($env:hash -and $env:hash -notlike \"null\") { $Hash = $env:hash }\r\n    if ($env:algorithm -and $env:algorithm -notlike \"null\") { $Algorithm = $env:algorithm }\r\n    if ($env:daysSinceLastModification -and $env:daysSinceLastModification -notlike \"null\") { $Days = $env:daysSinceLastModification }\r\n    if ($env:hoursSinceLastModification -and $env:hoursSinceLastModification -notlike \"null\") { $Hours = $env:hoursSinceLastModification }\r\n    if ($env:minutesSinceLastModification -and $env:minutesSinceLastModification -notlike \"null\") { $Minutes = $env:minutesSinceLastModification }\r\n\r\n    # Test for local administrator permissions\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Warning -Message \"Some files or folders may require local Administrator permissions to view.\"\r\n    }\r\n\r\n    # Verify the given algorithm is supported by PowerShell\r\n    $AllowedAlgorithms = \"SHA1\", \"SHA256\", \"SHA384\", \"SHA512\", \"MD5\"\r\n    if ($AllowedAlgorithms -notcontains $Algorithm) {\r\n        Write-Host \"[Error] Invalid Algorithm selected ($Algorithm)! Allowed selections are 'SHA1','SHA256','SHA384','SHA512' and 'MD5'.\"\r\n        exit 1\r\n    }\r\n\r\n    # Check for required parameter\r\n    if (-Not ($Path)) {\r\n        Write-Host \"[Error] A filepath is required!\"\r\n        Exit 1\r\n    }\r\n\r\n    switch ($Alert) {\r\n        \"Alert If Change\" { Write-Verbose \"Alerting if file $Path has been modified.\" }\r\n        \"Alert If No Change\" { Write-Verbose \"Alerting if file $Path has not been modified.\" }\r\n        default { Write-Verbose \"No alert was selected.\" }\r\n    }\r\n\r\n    $ExitCode = 0\r\n}\r\nprocess {\r\n\r\n    # File existence check\r\n    if ($Path -and -Not (Test-Path $Path -ErrorAction SilentlyContinue)) {\r\n        Write-Host \"[Alert] $Path does not exist!\"\r\n        Exit 1\r\n    }\r\n    else {\r\n        Write-Host \"$Path exists!\"\r\n    }\r\n\r\n    # Confirm we were given a filepath and not a directory\r\n    $File = Get-Item -Path $Path -ErrorAction SilentlyContinue\r\n    if ($File.PSIsContainer) {\r\n        Write-Host \"[Error] Please provide a file path, not a directory.\"\r\n        Exit 1\r\n    }\r\n\r\n    # If given the files hash verify it matches\r\n    if ($Hash) {\r\n        $CurrentHash = Get-FileHash -Path $File.FullName -Algorithm $Algorithm | Select-Object -ExpandProperty Hash\r\n        Write-Host \"Hash Given: $Hash\"\r\n        Write-Host \"Current Hash: $CurrentHash\"\r\n\r\n        if ($Hash -notlike $CurrentHash) {\r\n            Write-Host \"Hash mismatch!\"\r\n\r\n            if($Alert -eq \"Alert If Change\"){\r\n                Write-Host \"[Alert] File has been modified!\"\r\n                $ExitCode = 1\r\n            }\r\n        }\r\n        else {\r\n            Write-Host \"Hash matches!\"\r\n\r\n            if($Alert -eq \"Alert If No Change\"){\r\n                Write-Host \"[Alert] File has not been modified!\"\r\n                $ExitCode = 1\r\n            }\r\n        }\r\n    }\r\n\r\n    # Get the current date and subtract the days, hours and minutes to compare with the file \r\n    $Cutoff = Get-Date\r\n    $CurrentDate = $Cutoff\r\n\r\n    if ($Days) { $Cutoff = $Cutoff.AddDays(-$Days) }\r\n    if ($Hours) { $Cutoff = $Cutoff.AddHours(-$Hours) }\r\n    if ($Minutes) { $Cutoff = $Cutoff.AddMinutes(-$Minutes) }\r\n\r\n    $TimeSpan = New-TimeSpan $Cutoff $CurrentDate\r\n\r\n    if (($Days -or $Hours -or $Minutes) -and ($Cutoff -ne $CurrentDate)) {\r\n        Write-Host \"Checking if the file was modified in the last $($TimeSpan.ToString(\"dd' day(s) 'hh' hour(s) 'mm' minute(s)'\"))\"\r\n        Write-Host \"File was last modified on $($File.LastWriteTime).\"\r\n\r\n        if ($File.LastWriteTime -ge $Cutoff) {\r\n            Write-Host \"File has been updated within the time period.\"\r\n\r\n            if($Alert -eq \"Alert If Change\"){\r\n                Write-Host \"[Alert] File has been modified!\"\r\n                $ExitCode = 1\r\n            }\r\n        }\r\n        else {\r\n            Write-Host \"File has not been updated within the time period.\"\r\n\r\n            if($Alert -eq \"Alert If No Change\"){\r\n                Write-Host \"[Alert] File has not been modified!\"\r\n                $ExitCode = 1\r\n            }\r\n        }\r\n    }\r\n\r\n    Exit $ExitCode\r\n}\r\nend {<\/pre>\n
 <\/p>\n\n
<\/h2>
<\/p><\/div>
<\/a><\/div><\/div>\n
An\u00e1lisis detallado<\/h2>\n
Este script de PowerShell para monitorizar las modificaciones de los archivos est\u00e1 dise\u00f1ado para comprobar la existencia de un archivo, verificar si se ha modificado en un periodo de tiempo determinado y realizar una comprobaci\u00f3n hash para garantizar la integridad del archivo. Desglosemos el script paso a paso:<\/p>\n
    \n
  1. Definici\u00f3n de par\u00e1metros<\/strong>: el script para monitorizar las modificaciones de los archivos comienza definiendo par\u00e1metros, incluyendo Alerta, Ruta, Hash, Algoritmo, D\u00edas, Horas y Minutos. Estos par\u00e1metros permiten a los usuarios especificar el archivo que se va a supervisar, el hash esperado, el algoritmo hash y el plazo de tiempo para las comprobaciones de modificaci\u00f3n.<\/li>\n
  2. Sustituci\u00f3n de variables de entorno<\/strong>: el script sustituye din\u00e1micamente los par\u00e1metros por variables de entorno si est\u00e1n configuradas. Esta flexibilidad permite una f\u00e1cil integraci\u00f3n con sistemas automatizados y scripts.<\/li>\n
  3. Comprobaci\u00f3n de permisos de administrador<\/strong>: se utiliza una funci\u00f3n Test-IsElevated para verificar si el script para monitorizar las modificaciones de los archivos se est\u00e1 ejecutando con privilegios de administrador, asegurando que tiene los permisos necesarios para acceder y monitorizar los archivos especificados.<\/li>\n
  4. Validaci\u00f3n del algoritmo<\/strong>: el script comprueba si el algoritmo hash proporcionado es compatible. Los algoritmos permitidos son SHA1, SHA256, SHA384, SHA512 y MD5.<\/li>\n
  5. Comprobaci\u00f3n de existencia y tipo de fichero<\/strong>: el script\u00a0para monitorizar las modificaciones de los archivos\u00a0verifica si la ruta especificada existe y confirma que es un archivo, no un directorio.<\/li>\n
  6. Verificaci\u00f3n Hash<\/strong>: si se proporciona un hash, el script calcula el hash actual del archivo utilizando el algoritmo especificado y lo compara con el hash dado. A continuaci\u00f3n, alerta si hay una falta de coincidencia o si el archivo no se ha modificado en funci\u00f3n del par\u00e1metro Alerta.<\/li>\n
  7. Comprobaci\u00f3n del tiempo de modificaci\u00f3n<\/strong>: el script para monitorizar las modificaciones de los archivos calcula la hora l\u00edmite en funci\u00f3n de los par\u00e1metros D\u00edas, Horas y Minutos. A continuaci\u00f3n, compara la \u00faltima hora de modificaci\u00f3n del archivo con la hora de corte y emite una alerta si el archivo se ha modificado o no en el plazo especificado.<\/li>\n<\/ol>\n
    Posibles casos de uso<\/h2>\n
    Imagina a un profesional de TI responsable de mantener la seguridad<\/a> e integridad de los archivos de configuraci\u00f3n sensibles de un servidor. Con este script para monitorizar las modificaciones de los archivos, puede configurar una comprobaci\u00f3n diaria para verificar si se ha alterado alg\u00fan archivo cr\u00edtico. Por ejemplo, podr\u00eda utilizar el script para supervisar un archivo de configuraci\u00f3n, asegur\u00e1ndose de que no se ha modificado inesperadamente. Si el script detecta un cambio, emite una alerta que permite al profesional inform\u00e1tico investigar y tomar las medidas oportunas.<\/p>\n
    Comparaciones<\/h2>\n
    En comparaci\u00f3n con otros m\u00e9todos para supervisar los cambios en los archivos, como el uso de software de terceros o las comprobaciones manuales, este script de PowerShell para monitorizar las modificaciones de los archivos ofrece varias ventajas:<\/p>\n