{"id":221861,"date":"2024-03-26T16:19:14","date_gmt":"2024-03-26T16:19:14","guid":{"rendered":"https:\/\/www.ninjaone.com\/?post_type=script_hub&#038;p=221861"},"modified":"2024-03-26T16:19:40","modified_gmt":"2024-03-26T16:19:40","slug":"hur-man-soker-modifierad-vardfil-med-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/sv\/script-hub\/hur-man-soker-modifierad-vardfil-med-powershell\/","title":{"rendered":"Hur man s\u00f6ker efter en modifierad v\u00e4rdfil med PowerShell"},"content":{"rendered":"<p>I det stora IT-omr\u00e5det st\u00e5r hosts-filen som en tyst vaktpost och ser till att n\u00e4tverkskommunikationen fungerar smidigt. F\u00f6r den som inte k\u00e4nner till det \u00e4r <a href=\"https:\/\/www.ninjaone.com\/blog\/what-is-a-hosts-file\/\">hosts-filen<\/a> en textfil som mappar v\u00e4rdnamn till IP-adresser. Det anv\u00e4nds av operativsystemet f\u00f6r att omvandla v\u00e4rdnamn till IP-adresser n\u00e4r en dator f\u00f6rs\u00f6ker ansluta till en n\u00e4tverksresurs. Men vad h\u00e4nder om <strong>hosts-filen manipuleras eller \u00e4ndras<\/strong>? Hur kan IT-specialister och IT-partners (MSP) s\u00e4kerst\u00e4lla integriteten hos denna viktiga fil? G\u00e5 in i det manus som vi nu ska f\u00f6rdjupa oss i.<\/p>\n<h2>F\u00f6rst\u00e5else av filen Hosts<\/h2>\n<p>Hosts-filen \u00e4r i grund och botten datorsystemets adressbok. Den spelar en avg\u00f6rande roll n\u00e4r det g\u00e4ller att dirigera n\u00e4tverkstrafiken och se till att anv\u00e4ndarna hamnar p\u00e5 r\u00e4tt webbplatser och tj\u00e4nster. Men dess betydelse g\u00f6r den \u00e4ven till ett viktigt m\u00e5l f\u00f6r skadliga akt\u00f6rer.<\/p>\n<h2>Potentiella risker med obeh\u00f6riga \u00e4ndringar<\/h2>\n<p>En angripare med skumma avsikter kan \u00e4ndra hosts-filen s\u00e5 att trafiken omdirigeras till en skadlig webbplats eller server. S\u00e5dana \u00e4ndringar kan f\u00e5 \u00f6desdigra konsekvenser:<\/p>\n<ul>\n<li><strong>Stj\u00e4la personlig information<\/strong>: Genom att omdirigera anv\u00e4ndare till f\u00f6rfalskade webbplatser kan angriparna fiska efter personliga uppgifter, vilket kan leda till identitetsst\u00f6ld.<\/li>\n<li><strong>Installation av skadlig kod<\/strong>: Anv\u00e4ndare kan luras att ladda ner skadlig programvara i tron att de befinner sig p\u00e5 en legitim webbplats.<\/li>\n<li><strong>St\u00f6rning av n\u00e4tverkskommunikation<\/strong>: Viktiga tj\u00e4nster kan blockeras och orsaka driftst\u00f6rningar.<\/li>\n<\/ul>\n<p>Med tanke p\u00e5 dessa risker \u00e4r det av st\u00f6rsta vikt att IT-personal och IT-partners har verktyg som snabbt kan uppt\u00e4cka eventuella obeh\u00f6riga \u00e4ndringar. Det \u00e4r h\u00e4r v\u00e5rt manus kommer in i bilden.<\/p>\n<h2>Manus<\/h2>\n<pre class=\"EnlighterJSRAW\" data-enlighter-language=\"generic\">#Requires -Version 5.1\r\n\r\n&lt;#\r\n.SYNOPSIS\r\n    Checks if the hosts file was modified from last run.\r\n.DESCRIPTION\r\n    Checks if the hosts file was modified from last run.\r\n    On first run this will not produce an error, but will create a cache file for later comparison.\r\n.EXAMPLE\r\n    No parameters needed.\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#&gt;\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    # Path and file of the hosts file\r\n    [string]\r\n    $HostsPath = \"C:WindowsSystem32driversetchosts\",\r\n    # Path and file where the cache file will be saved for comparison\r\n    [string]\r\n    $CachePath = \"C:ProgramDataNinjaRMMAgentscriptingTest-HostsFile.clixml\"\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    # Check if hosts file exists\r\n    if ($(Test-Path -Path $HostsPath)) {\r\n        # Get content and create hash of hosts file\r\n        $HostsContent = Get-Content -Path $HostsPath\r\n        $HostsHash = Get-FileHash -Path $HostsPath -Algorithm SHA256\r\n\r\n        $Current = [PSCustomObject]@{\r\n            Content = $HostsContent\r\n            Hash    = $HostsHash\r\n        }\r\n\r\n        # Check if this is first run or not\r\n        if ($(Test-Path -Path $CachePath)) {\r\n            # Compare last content and hash\r\n            $Cache = Import-Clixml -Path $CachePath\r\n            $ContentDifference = Compare-Object -ReferenceObject $Cache.Content -DifferenceObject $Current.Content -CaseSensitive\r\n            $HashDifference = $Cache.Hash -like $Current.Hash\r\n            $Current | Export-Clixml -Path $CachePath -Force -Confirm:$false\r\n            if (-not $HashDifference) {\r\n                Write-Host \"Hosts file has changed since last run!\"\r\n                Write-Host \"\"\r\n                $ContentDifference | ForEach-Object {\r\n                    if ($_.SideIndicator -like '=&gt;') {\r\n                        Write-Host \"Added: $($_.InputObject)\"\r\n                    }\r\n                    elseif ($_.SideIndicator -like '&lt;=') {\r\n                        Write-Host \"Removed: $($_.InputObject)\"\r\n                    }\r\n                }\r\n                exit 1\r\n            }\r\n        }\r\n        else {\r\n            Write-Host \"First run, saving comparison cache file.\"\r\n            $Current | Export-Clixml -Path $CachePath -Force -Confirm:$false\r\n        }\r\n    }\r\n    else {\r\n        Write-Error \"Hosts file is missing!\"\r\n        exit 1\r\n    }\r\n    exit 0\r\n}\r\nend {}<\/pre>\n<p>&nbsp;<\/p>\n\n<div class=\"in-context-cta\"><p>F\u00e5 tillg\u00e5ng till \u00f6ver 300 skript i NinjaOne Dojo<\/p>\n<p><a href=\"https:\/\/www.ninjaone.com\/sv\/kostnadsfri-provperiod-formular\">F\u00e5 tillg\u00e5ng till<\/a><\/p>\n<\/div>\n<h2>En djupdykning i manuset<\/h2>\n<p>Det medf\u00f6ljande PowerShell-skriptet \u00e4r utformat f\u00f6r att kontrollera om hosts-filen har \u00e4ndrats sedan den senaste k\u00f6rningen. H\u00e4r \u00e4r en sammanfattning av dess funktionalitet:<\/p>\n<ol>\n<li><strong>Kontroll av h\u00f6jd<\/strong>: Skriptet kontrollerar f\u00f6rst om det k\u00f6rs med administrat\u00f6rsbeh\u00f6righet. Detta \u00e4r viktigt eftersom alla f\u00f6rs\u00f6k att l\u00e4sa eller \u00e4ndra systemfiler kr\u00e4ver f\u00f6rh\u00f6jda beh\u00f6righeter.<\/li>\n<li><strong>V\u00e4rdar Filverifiering<\/strong>: Den kontrollerar sedan att hosts-filen finns. Om filen saknas flaggar skriptet f\u00f6r ett fel.<\/li>\n<li><strong>J\u00e4mf\u00f6relse av hash<\/strong>: Skriptet ber\u00e4knar en hash (SHA256) av den aktuella hosts-filen och j\u00e4mf\u00f6r den med en cachad version fr\u00e5n den senaste k\u00f6rningen. Om det inte finns n\u00e5gon matchning indikerar det att filen har \u00e4ndrats.<\/li>\n<li><strong>J\u00e4mf\u00f6relse av inneh\u00e5ll<\/strong>: Ut\u00f6ver att bara kontrollera hashen j\u00e4mf\u00f6r skriptet \u00e4ven inneh\u00e5llet rad f\u00f6r rad och markerar eventuella till\u00e4gg eller borttagningar.<\/li>\n<\/ol>\n<h2>F\u00f6rdelar f\u00f6r IT-proffs och IT-partners<\/h2>\n<ul>\n<li><strong>Proaktiv \u00f6vervakning<\/strong>: Detta skript erbjuder en proaktiv metod f\u00f6r att \u00f6vervaka hosts-filen, s\u00e4kerst\u00e4lla dess integritet och varna administrat\u00f6rer om eventuella obeh\u00f6riga \u00e4ndringar.<\/li>\n<li><strong>Detaljerade insikter<\/strong>: Genom att j\u00e4mf\u00f6ra skillnader i inneh\u00e5ll kan IT-teamen snabbt identifiera vad som har lagts till eller tagits bort, vilket underl\u00e4ttar en snabb korrigering.<\/li>\n<li><strong>Redo f\u00f6r automatisering<\/strong>: Tack vare sin utformning kan skriptet integreras i automatiserade arbetsfl\u00f6den, vilket m\u00f6jligg\u00f6r regelbundna kontroller utan manuella ingrepp.<\/li>\n<\/ul>\n<h2>Kraften i NinjaOne<\/h2>\n<p>NinjaOne \u00e4r mer \u00e4n bara en IT-hanteringsl\u00f6sning. Det \u00e4r en helt\u00e4ckande plattform som ger IT-proffs och IT-partners m\u00f6jlighet att ligga steget f\u00f6re potentiella hot. Genom att integrera v\u00e5rt skript f\u00f6r kontroll av hosts-filer i NinjaOne:<\/p>\n<ul>\n<li><strong>Centraliserade varningar<\/strong>: F\u00e5 varningar direkt p\u00e5 NinjaOnes instrumentpanel n\u00e4r v\u00e4rdfilen \u00e4ndras. Detta omedelbara meddelande s\u00e4kerst\u00e4ller att du kan agera snabbt och skydda dina system fr\u00e5n potentiella attacker.<\/li>\n<li><strong>Schemalagda kontroller<\/strong>: Automatisera skriptet s\u00e5 att det k\u00f6rs med angivna intervall, vilket s\u00e4kerst\u00e4ller kontinuerlig \u00f6vervakning.<\/li>\n<li><strong>Detaljerad rapportering<\/strong>: Kombinera insikterna fr\u00e5n skriptet med NinjaOnes rapporteringsfunktioner f\u00f6r att f\u00e5 en helhetsbild av din IT-milj\u00f6.<\/li>\n<\/ul>\n<p>Sammanfattningsvis \u00e4r hosts-filen, \u00e4ven om den ofta f\u00f6rbises, en h\u00f6rnsten i n\u00e4tverkskommunikation. Att s\u00e4kerst\u00e4lla dess integritet \u00e4r av st\u00f6rsta vikt. V\u00e5rt skript, s\u00e4rskilt i kombination med kraften i NinjaOne, ger IT-teams de verktyg de beh\u00f6ver f\u00f6r att <a href=\"https:\/\/www.ninjaone.com\/sv\/endpoint-hantering\/fjarrovervakning-och-varningar\">\u00f6vervaka, uppt\u00e4cka och agera mot obeh\u00f6riga \u00e4ndringar, vilket garanterar en s\u00e4ker och smidig IT-milj\u00f6<\/a>.<\/p>\n","protected":false},"author":35,"featured_media":142198,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[4249],"class_list":["post-221861","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows","use_cases-allman-konfiguration"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/script_hub\/221861","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/comments?post=221861"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/media\/142198"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/media?parent=221861"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/operating_system?post=221861"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/sv\/wp-json\/wp\/v2\/use_cases?post=221861"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}