import os
import sys
import csv
from tkinter import filedialog
import pandas
from tkinter import Tk

from tkinter.filedialog import askdirectory
path = askdirectory(title='Select Folder') # shows dialog box and return the path
print(path)  
#IF YOU NEED TO SELECT THE FULL PATH NAME FOR A SINGLE DIRECTORY, USE THE LINE BELOW
# user_input = 'C:/Users/ivory.wilds/Desktop/HAFNIUM EXCHANGE WORK/Bolton and Menk/exchangeLogs/logs/Exchange Logs/HttpProxy/Ecp'
directory = os.listdir(path)

# Hafnium IOCs found at https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Sample%20Data/Feeds/MSTICIoCs-ExchangeServerVulnerabilitiesDisclosedMarch2021.csv
searchstring = [
                ".7z",
                ".rar",
                ".zip",
                "Jscript",
                "SnapIn",
                "Snapin",
                "Get-MailboxExportRequest",
                "Remove-MailboxExportRequest",
                "powershell -nop -c",
                "powercat -c",
                "Base64",
                "base64",
                "FromBase64String",
                "Page Language=",
                "?php @eval",
                "IEX (New-Object System.)",
                "powercat",
                "Server~*/*~*",
                "ServerInfo~*/*",
                "\Microsoft\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\log.aspx",
                "/Microsoft/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/log.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\logg.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/logg.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\logout.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/logout.aspx",
                "/Server.aspx",
                "/Server.aspx",
                "\inetpub\wwwroot\\aspnet_client\\aspnet_client.aspx",
                "/inetpub/wwwroot/aspnet_client/aspnet_client.aspx",
                "\inetpub\wwwroot\\aspnet_client\\aspnet_iisstart.aspx",
                "/inetpub/wwwroot/aspnet_client/aspnet_iisstart.aspx",
                "\inetpub\wwwroot\\aspnet_client\\aspnet_pages.aspx",
                "/inetpub/wwwroot/aspnet_client/aspnet_pages.aspx",
                "\inetpub\wwwroot\\aspnet_client\\aspnet_www.aspx",
                "/inetpub/wwwroot/aspnet_client/aspnet_www.aspx",
                "\inetpub\wwwroot\\aspnet_client\default1.aspx",
                "/inetpub/wwwroot/aspnet_client/default1.aspx",
                "\inetpub\wwwroot\\aspnet_client\errorcheck.aspx",
                "/inetpub/wwwroot/aspnet_client/errorcheck.aspx",
                "\inetpub\wwwroot\\aspnet_client\iispage.aspx",
                "/inetpub/wwwroot/aspnet_client/iispage.aspx",
                "\inetpub\wwwroot\\aspnet_client\s.aspx",
                "/inetpub/wwwroot/aspnet_client/s.aspx",
                "\inetpub\wwwroot\\aspnet_client\session.aspx",
                "/inetpub/wwwroot/aspnet_client/session.aspx",
                "\inetpub\wwwroot\\aspnet_client\shell.aspx",
                "/inetpub/wwwroot/aspnet_client/shell.aspx",
                "\inetpub\wwwroot\\aspnet_client\system_web\log.aspx",
                "/inetpub/wwwroot/aspnet_client/system_web/log.aspx",
                "\inetpub\wwwroot\\aspnet_client\\xclkmcfldfi948398430fdjkfdkj.aspx",
                "/inetpub/wwwroot/aspnet_client/xclkmcfldfi948398430fdjkfdkj.aspx",
                "\inetpub\wwwroot\\aspnet_client\\xx.aspx",
                "/inetpub/wwwroot/aspnet_client/xx.aspx",
                "\inetpub\wwwroot\\aspnet_client\Server.aspx",
                "/inetpub/wwwroot/aspnet_client/Server.aspx",
                "\inetpub\wwwroot\\aspnet_client\discover.aspx",
                "/inetpub/wwwroot/aspnet_client/discover.aspx",
                "\inetpub\wwwroot\\aspnet_client\HttpProxy.aspx",
                "/inetpub/wwwroot/aspnet_client/HttpProxy.aspx",
                "\inetpub\wwwroot\\aspnet_client\OutlookEN.aspx",
                "/inetpub/wwwroot/aspnet_client/OutlookEN.aspx",
                "\inetpub\wwwroot\\aspnet_client\supp0rt.aspx",
                "/inetpub/wwwroot/aspnet_client/supp0rt.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\default.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/default.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\\a.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/a.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\shel90.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/shel90.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\shel2.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/shel2.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\shel.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/shel.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\one.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/one.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\\fatal-erro.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/fatal-erro.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\errorPages.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/errorPages.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\errorPage.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/errorPage.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\current\one1.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/current/one1.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/bob.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\\bob.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/authhead.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/authhead.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\OutlookZH.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/OutlookZH.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\8Lw7tAhF9i1pJnRo.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/8Lw7tAhF9i1pJnRo.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\OAB\log.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/OAB/log.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\log.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/log.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\logg.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/logg.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\logout.aspx",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/logout.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\Current\google.log",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/Current/google.log",
                "\inetpub\wwwroot\\aspnet_client\google.log",
                "/inetpub/wwwroot/aspnet_client/google.log",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\google.log",
                "/Exchange Server/V15/FrontEnd/HttpProxy/owa/auth/google.log",
                "\Microsoft\Exchange Server\V15\Logging\OABGeneratorLog\\",
                "/Microsoft/Exchange Server/V15/Logging/OABGeneratorLog/",
                "/DDI/DDIService.svc/GetObject?",
                "/DDI/DDIService.svc/SetObject?",
                "CMD=Set-OabVirtualDirectory.ExternalUrl=",
                "Set-OabVirtualDirectory.ExternalUrl",
                "86.105.18.116",
                "89.34.111.11",
                "/help.aspx",
                "/iisstart.aspx",
                "182.18.152.105", 
                "165.232.154.116",
                "CMD=",
                "Get-ExchangeServer.Identity",
                #"/autodiscover",
                "c103w-a.zip",
                "dnl.zip",
                "Od.lk",
                "cdn.chatcdn.net/p?hig210305",
                "Set-OabVirtualDirectory",
                "/owa/auth/google.log",
                "\owa\\auth\google.log",
                "104.225.219.16",
                "159.89.95.163",
                "198.50.168.176",
                "45.154.2.94",
                "34.87.113.30",
                "185.173.235.172",
                "185.173.235.54",
                "185.65.134.165"
                "103.77.192.219",
                "104.140.114.110",
                "104.250.191.110", 
                "108.61.246.56",
                "149.28.14.163",
                "157.230.221.198",
                "167.99.168.251",
                "185.250.151.72",
                "192.81.208.169",
                "203.160.69.66",
                "211.56.98.146",
                "5.254.43.18",
                "80.92.205.81",
                "165.232.154.116",
                "104.248.49.97",
                "5.2.69.13",
                "91.192.103.43",
                "161.35.45.41",
                "45.77.252.175",
                "1.36.203.86",
                "1.65.152.106",
                "103.212.223.210",
                "104.225.219.16",
                "108.172.93.199",
                "110.36.235.230",
                "110.36.238.2",
                "110.39.189.202",
                "112.168.90.84",
                "114.205.37.150",
                "116.49.101.143",
                "117.146.53.162",
                "119.197.26.38",
                "119.231.129.222",
                "121.154.50.51",
                "121.174.31.220",
                "121.176.145.25",
                "122.213.178.102",
                "123.16.231.247",
                "124.5.24.161",
                "139.59.56.239",
                "161.35.76.1",
                "167.179.67.3",
                "170.10.228.74",
                "172.105.87.139",
                "179.1.65.54",
                "182.165.53.4",
                "185.171.166.188",
                "185.224.83.137",
                "200.52.177.138",
                "201.17.196.211",
                "201.208.18.226",
                "202.182.118.99",
                "209.58.163.131",
                "211.177.182.80",
                "213.219.235.158",
                "218.39.251.104",
                "219.100.37.239",
                "219.100.37.243",
                "219.78.205.63",
                "23.95.80.191",
                "31.182.197.163",
                "31.28.31.132",
                "34.87.189.145",
                "39.123.17.120",
                "46.101.232.43",
                "46.23.196.21",
                "49.36.47.211",
                "58.126.135.235",
                "58.190.46.175",
                "61.82.150.49",
                "78.188.104.84",
                "78.189.225.136",
                "86.105.18.116",
                "89.147.119.227",
                "90.230.190.92",
                "1.9.2.18",
                "103.135.248.70",
                "108.61.171.184",
                "113.173.3.225",
                "128.90.21.223",
                "159.89.95.163",
                "182.18.152.105",
                "185.65.134.165",
                "185.65.134.170",
                "34.87.113.30",
                "46.244.29.17",
                "103.77.192.219",
                "104.140.114.110",
                "104.250.191.110",
                "108.61.246.56",
                "149.28.14.163",
                "157.230.221.198",
                "167.99.168.251",
                "185.250.151.72",
                "192.81.208.169",
                "203.160.69.66",
                "211.56.98.146",
                "5.254.43.18",
                "80.92.205.81",
                "5.189.162.164",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\Current\\themes\\resources\logon.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\ecp\\auth\TimeoutLogout.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\ews\\333.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\OutlookUS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackOutLookEN.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackCookiePL.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackIdAR.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackOutLookAR.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackReplaceIO.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackPassDA.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLangPL.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackPassPL.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackCookieAS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackPassAS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackReplacePL.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackIdAS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLogsAS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackReplaceAS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackOutLookAS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLogsSE.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackOutLookSE.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLangDA.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackCookieDA.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackCookieAR.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackAuthAS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackCookieSE.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackOutLookPL.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackAuthAR.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackIdIO.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLogsIO.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLangAS.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackIdEN.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackIdDA.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackIdSE.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackAuthDA.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackReplaceSE.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackPassSE.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLangEN.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackPassAR.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLangES.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackPassES.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackCookieEN.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLangAR.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackIdES.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackPassEN.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLogsAR.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackIdPL.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackOutLookES.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackReplaceES.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackCookieES.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackReplaceEN.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackAuthSE.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLangSE.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLangIO.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackCookieIO.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackLogsDA.aspx",
                "\Exchange Server\V15\FrontEnd\HttpProxy\owa\\auth\ChackPassIO.aspx",
                "/ecp/VDirMgmt/ResetVirtualDirectory.aspx",
                "brian.krebsonsecurity.top",
                "krebsonsecurity.top",
                "jennifer.krebsonsecurity.top"]

FILENAMES=[]
for root, dirs, files in os.walk(path):
    for filename in files:
        #the file extension needs to be changed depending upon desired file type (i.e. log, txt, docx)
        if(filename.endswith('.LOG')):
            FILENAMES.append(filename)
            for i in searchstring:
                longName = (root + os.sep + filename)
                f = open(longName, 'r')
                if i in f.read():
                    print('found ' + i + ' in  %s' % longName )
            f.close()
        #This section will check to see if there are any CSVs and if so, it will check them for IOC string matches
        if(filename.endswith('.csv')):
            FILENAMES.append(filename)
            #print(FILENAMES)
            longName = (root + os.sep + filename)
            #print(longName)
            df = pandas.read_csv(longName)
            for i in searchstring:
                if i in df.values:
                    print('found ' + i + ' in  %s' % longName )