Worklet - Analyze Wi-Fi 48 hours and store in CSV

This worklet takes advantage of output from netsh wlan show interfaces. The idea is to start a scheduled task and run that command every 30 minutes for 48 hours. The results are all stored in a CSV file on the drive for review later.

#remediation code

#Params
$TaskName = 'Wi-Fi Analysis 48-Hours'
$csv = 'Wi-Fi_Analysis.csv'
$workdir = 'C:\ProgramData\company\'
$file = $workdir + $csv
$repeatmin = 30 #minutes
$duration = 48 #hours

#cleanup before starting
IF(Test-Path $file){Remove-Item $file -Force}
$task = schtasks /query /tn "$TaskName"
IF($task){schtasks /Delete /TN "$TaskName"}

function Build-Scripts{
# Build script that will send message
$vbs = @"
command = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -windowstyle hidden -File $workdir`Get-wlanInterface.ps1 -Force"
 set shell = CreateObject("WScript.Shell")
 shell.Run command,0
"@
New-Item -Path "$workdir" -Name "RunPowerShellScript.vbs" -ItemType "file" -Value $vbs -force | Out-Null

$powershell = @"
`$interfaces = netsh wlan show interfaces
`$wlan = [pscustomobject] @{
    Name = `$interfaces | Select-String -Pattern "Name" | % {((`$_ -split ":").Trim())[1]}
    Description = `$interfaces | Select-String -Pattern "Description" | % {((`$_ -split ":").Trim())[1]}
    GUID = `$interfaces | Select-String -Pattern "GUID" | % {((`$_ -split ":").Trim())[1]}
    'Physical address' = (`$interfaces | Select-String -Pattern "Physical address" | % {((`$_ -split ":").Trim())[1..6]}) -Join ":"
    State = `$interfaces | Select-String -Pattern "State" | % {((`$_ -split ":").Trim())[1]}
    SSID = (`$interfaces | Select-String -Pattern "SSID")[0] | % {((`$_ -split ":").Trim())[1]}
    BSSID = (`$interfaces | Select-String -Pattern "BSSID" | % {((`$_ -split ":").Trim())[1..6]}) -Join ":"
    'Network type' = `$interfaces | Select-String -Pattern "Network type" | % {((`$_ -split ":").Trim())[1]}
    'Radio type' = `$interfaces | Select-String -Pattern "Radio type" | % {((`$_ -split ":").Trim())[1]}
    'Authentication' = `$interfaces | Select-String -Pattern "Authentication" | % {((`$_ -split ":").Trim())[1]}
    Cipher = `$interfaces | Select-String -Pattern "Cipher" | % {((`$_ -split ":").Trim())[1]}
    'Connection mode' = `$interfaces | Select-String -Pattern "Connection mode" | % {((`$_ -split ":").Trim())[1]}
    Channel = `$interfaces | Select-String -Pattern "Channel" | % {((`$_ -split ":").Trim())[1]}
    'Receive rate (Mbps)' = `$interfaces | Select-String -Pattern "Receive rate" | % {((`$_ -split ":").Trim())[1]}
    'Transmit rate (Mbps)' = `$interfaces | Select-String -Pattern "Transmit rate" | % {((`$_ -split ":").Trim())[1]}
    Signal = `$interfaces | Select-String -Pattern "Signal" | % {((`$_ -split ":").Trim())[1]} 
    Profile = `$interfaces | Select-String -Pattern "Profile" | % {((`$_ -split ":").Trim())[1]} 
}
`$wlan | Export-Csv '$file' -Notypeinformation -Append
"@
New-Item -Path "$workdir" -Name "Get-wlanInterface.ps1" -ItemType "file" -Value $powershell -force | Out-Null

}
Build-Scripts

# Setup Scheduled Task
$action = New-ScheduledTaskAction -Execute "cscript" -Argument "$workdir\RunPowerShellScript.vbs"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes $repeatmin) -RepetitionDuration (New-TimeSpan -Hours $duration)
$desc = "Writes output of netsh wlan show interfaces to $output"
$task = Register-ScheduledTask -TaskName $TaskName -Action $action -Trigger $trigger -Description $desc -User "NT AUTHORITY\SYSTEM"
Start-ScheduledTask -TaskName $TaskName
1 Like