Sorry that is not what I wanted it to do, so I said " Now roll all of that one into one artifact "
And here's I got:
Perfect — here’s a
single Windows PowerShell “all-in-one” artifact that bundles everything:
- EICAR variants (multi-extension, archives, nested, optional passworded ZIP)
- “Fishy-looking” samples (RLO filename, double-extension, ADS, Zone.Identifier, hidden/system attrs, high-entropy blob, benign LNK)
- EFS-encrypt dan.txt
- Optional local HTTP server to test download/stream scanning
- Optional GTUBE email sender
- Inventory logs (CSV + JSON) with path, size, SHA-256, attributes, and Encrypted flag
Run on Windows 10/11, PowerShell 5+. No admin required. EFS needs NTFS + Pro/Enterprise/Education.
<#
All-In-One Safe Test Artifact for CyberLock/SirusLLM (Windows)
Generates harmless but “suspicious-looking” files + EICAR/GTUBE controls, EFS encryption on dan.txt,
optional local HTTP server, and full inventory logging.
Examples:
.\AllInOne-CyberLock.ps1
.\AllInOne-CyberLock.ps1 -WithHttpServer -Port 8080
.\AllInOne-CyberLock.ps1 -OutDir "C:\Tests\CL"
#>
[CmdletBinding()]
param(
[switch]$WithHttpServer,
[int]$Port = 8080,
[string]$OutDir
)
# -------------------- Constants --------------------
$EICAR = 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*'
$GTUBE = 'XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X'
$RLO = [char]0x202E # Right-to-Left Override for filename trick
# -------------------- Output folder --------------------
if (-not $OutDir) {
$stamp = Get-Date -Format 'yyyyMMdd-HHmmss'
$OutDir = Join-Path $env:USERPROFILE "Desktop\CL-SafePack-$stamp"
}
New-Item -ItemType Directory -Path $OutDir -Force | Out-Null
Set-Location $OutDir
# -------------------- Helpers --------------------
function Write-AsciiNoNl([string]$Path,[string]$Text){
Set-Content -LiteralPath $Path -Value $Text -NoNewline -Encoding Ascii
}
function Add-InvRow {
param([string]$Path)
if (Test-Path -LiteralPath $Path) {
$fi = Get-Item -LiteralPath $Path -Force
$h = Get-FileHash -Algorithm SHA256 -LiteralPath $Path
$script:INV += [pscustomobject]@{
Path = $fi.FullName
Name = $fi.Name
SizeBytes = $fi.Length
SHA256 = $h.Hash
Attributes = $fi.Attributes.ToString()
Encrypted = ($fi.Attributes.ToString() -like '*Encrypted*')
CreatedUTC = $fi.CreationTimeUtc.ToString('o')
}
}
}
# Simple HTTP file server (Ctrl+C to stop)
function Start-SimpleHttpServer {
param([int]$Port,[string]$Root)
Add-Type -AssemblyName System.Net.HttpListener
$prefix = "http://localhost:$Port/"
$listener = [System.Net.HttpListener]::new()
$listener.Prefixes.Add($prefix)
$listener.Start()
Write-Host "Serving $Root at $prefix (Ctrl+C to stop)."
try {
while ($listener.IsListening) {
$ctx = $listener.GetContext()
$req = $ctx.Request
$res = $ctx.Response
$rel = $req.Url.AbsolutePath.TrimStart('/')
if ([string]::IsNullOrWhiteSpace($rel)) { $rel = 'index.html' }
$target = Join-Path $Root $rel
if (-not (Test-Path $target)) {
if ($rel -eq 'index.html') {
$links = (Get-ChildItem -File -Path $Root -Force | ForEach-Object { "<li><a href=""$($_.Name)"">$($_.Name)</a></li>" }) -join "`n"
$html = "<html><body><h3>CyberLock Test Files</h3><ul>$links</ul></body></html>"
$bytes = [Text.Encoding]::UTF8.GetBytes($html)
$res.ContentType = 'text/html; charset=utf-8'
$res.StatusCode = 200
$res.OutputStream.Write($bytes,0,$bytes.Length)
$res.Close(); continue
} else { $res.StatusCode = 404; $res.Close(); continue }
}
try {
$bytes = [System.IO.File]::ReadAllBytes($target)
$res.ContentType = 'application/octet-stream'
$res.StatusCode = 200
$res.AddHeader('Content-Disposition', "inline; filename=""$([IO.Path]::GetFileName($target))""")
$res.OutputStream.Write($bytes,0,$bytes.Length)
} catch { $res.StatusCode = 500 } finally { $res.Close() }
}
} finally { $listener.Stop(); $listener.Close() }
}
# Optional GTUBE email sender
function Send-GtubeTestEmail {
param(
[Parameter(Mandatory)] [string]$SmtpServer,
[Parameter(Mandatory)] [int]$Port,
[Parameter(Mandatory)] [string]$From,
[Parameter(Mandatory)] [string]$To,
[Parameter(Mandatory)] [string]$User,
[Parameter(Mandatory)] [string]$Password,
[switch]$UseSsl
)
Add-Type -AssemblyName System.Net.Mail
$msg = [System.Net.Mail.MailMessage]::new($From,$To)
$msg.Subject = 'GTUBE Anti-Spam Test'
$msg.Body = $GTUBE
$client = [System.Net.Mail.SmtpClient]::new($SmtpServer,$Port)
$client.EnableSsl = [bool]$UseSsl
$client.Credentials = New-Object System.Net.NetworkCredential($User,$Password)
$client.Send($msg)
"Sent GTUBE test email from $From to $To"
}
# -------------------- Generate Artifacts --------------------
$INV = @()
$noteList = @()
# A) EICAR variants (masquerading/extensions)
$eicarExts = @('com','exe','txt','pdf','docx','bin')
$eicarFiles = @()
foreach ($ext in $eicarExts) {
$p = Join-Path $OutDir ("eicar.$ext")
Write-AsciiNoNl $p $EICAR
$eicarFiles += $p
Add-InvRow $p
}
# B) Fishy double-extension (looks like doc/PDF, is .exe)
$invoice = Join-Path $OutDir 'Invoice_Q3_2025.pdf.exe'
Write-AsciiNoNl $invoice $EICAR
Add-InvRow $invoice
# C) RLO filename trick (shows as photoexe.png)
$photo = Join-Path $OutDir ("photo$RLO" + "gnp.exe")
Write-AsciiNoNl $photo $EICAR
(Get-Item $photo).Attributes = 'Hidden','System'
Add-InvRow $photo
# D) Innocent carrier + ADS payload
$innocent = Join-Path $OutDir 'innocent.txt'
Write-AsciiNoNl $innocent 'hello'
Set-Content -LiteralPath "$innocent
ayload.bin" -Value $EICAR -NoNewline -Encoding Ascii
Add-InvRow $innocent # ADS ties to this file
# E) High-entropy blob (harmless random)
$packed = Join-Path $OutDir 'packed.bin'
$bytes = New-Object byte[] (200KB)
[Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
[IO.File]::WriteAllBytes($packed,$bytes)
Add-InvRow $packed
# F) Mark “downloaded from Internet” (Zone.Identifier ADS)
$zi = "[ZoneTransfer]`r`nZoneId=3`r`nReferrerUrl=
http://example.local/offer`r`nHostUrl=
http://example.local/download/invoice`r`n"
Set-Content -LiteralPath "$invoice:Zone.Identifier" -Value $zi -Encoding Unicode
Set-Content -LiteralPath "$photo:Zone.Identifier" -Value $zi -Encoding Unicode
# G) Archives: single + nested
$zip1 = Join-Path $OutDir 'eicar.zip'
$zip2 = Join-Path $OutDir 'eicar_nested.zip'
if (Test-Path $zip1) { Remove-Item $zip1 -Force }
if (Test-Path $zip2) { Remove-Item $zip2 -Force }
Compress-Archive -Path (Join-Path $OutDir 'eicar.com') -DestinationPath $zip1
Compress-Archive -Path $zip1 -DestinationPath $zip2
Add-InvRow $zip1
Add-InvRow $zip2
# H) Passworded ZIP (7-Zip, password: infected)
$zipPw = Join-Path $OutDir 'eicar_pw.zip'
$seven = Get-Command 7z.exe -ErrorAction SilentlyContinue
if ($seven) {
if (Test-Path $zipPw) { Remove-Item $zipPw -Force }
& $seven.Path a -tzip "-pinfected" -mem=AES256 $zipPw (Join-Path $OutDir 'eicar.com') | Out-Null
Add-InvRow $zipPw
} else {
$noteList += "7-Zip not found; skipping passworded zip ($zipPw). Install 7-Zip and re-run."
}
# I) Benign LNK pointing to Notepad
$wsh = New-Object -ComObject WScript.Shell
$lnkPath = Join-Path $OutDir 'Report_2025_Q3.pdf.lnk'
$lnk = $wsh.CreateShortcut($lnkPath)
$lnk.TargetPath = "$env:SystemRoot\System32\notepad.exe"
$lnk.IconLocation = "$env:SystemRoot\System32\shell32.dll,1"
$lnk.Save()
Add-InvRow $lnkPath
# J) Create + EFS-encrypt dan.txt
$dan = Join-Path $OutDir 'dan.txt'
"Dan EFS test - $(Get-Date -Format o)" | Set-Content -LiteralPath $dan -Encoding UTF8
$efsNote = Join-Path $OutDir 'NOTE-EFS.txt'
try {
$proc = Start-Process -FilePath "$env:SystemRoot\System32\cipher.exe" `
-ArgumentList "/E","/A","$dan" -NoNewWindow -PassThru -Wait
if ($proc.ExitCode -eq 0) {
$attr = (Get-Item -LiteralPath $dan -Force).Attributes
$isEnc = ($attr.ToString() -like "*Encrypted*")
$check = & "$env:SystemRoot\System32\cipher.exe" /C "$dan" 2>&1
if ($isEnc) {
"EFS encryption OK for: $dan`r`n`r`n$check" | Out-File -FilePath $efsNote -Encoding UTF8
} else {
"EFS attempted but file does not show Encrypted attribute. Details:`r`n$check" | Out-File -FilePath $efsNote -Encoding UTF8
}
} else {
"cipher.exe returned $($proc.ExitCode). EFS likely unsupported (requires NTFS + Pro/Ent/Edu)." |
Out-File -FilePath $efsNote -Encoding UTF8
}
} catch {
"EFS step failed: $($_.Exception.Message). If Windows Home or non-NTFS, EFS isn't available." |
Out-File -FilePath $efsNote -Encoding UTF8
}
Add-InvRow $dan
Add-InvRow $efsNote
# -------------------- Inventory logs --------------------
$csv = Join-Path $OutDir 'inventory.csv'
$json = Join-Path $OutDir 'inventory.json'
$INV | Sort-Object Name | Export-Csv -NoTypeInformation -Path $csv -Encoding UTF8
$INV | Sort-Object Name | ConvertTo-Json -Depth 4 | Out-File -FilePath $json -Encoding UTF8
# -------------------- Optional HTTP server --------------------
if ($WithHttpServer) {
Start-SimpleHttpServer -Port $Port -Root $OutDir
}
Write-Host "`n== Done =="
Write-Host "Output folder: $OutDir"
Write-Host "Logs: $csv , $json"
if (Test-Path $zipPw) { Write-Host "Passworded ZIP: $zipPw (password: infected)" }
Write-Host "EFS note: $efsNote"
Write-Host "Tip: test on-access, on-demand, extract ZIPs (incl. pw ZIP), download via HTTP, and verify telemetry vs inventory."
Quick use & checks
Run it, then:
Open/copy/rename items (on-access).
Scan the folder (on-demand).
Extract eicar.zip, eicar_nested.zip, and eicar_pw.zip (if present; pw infected).
If started with -WithHttpServer, download
http://localhost:8080/eicar.com.
Verify dan.txt is Encrypted: cipher /C "<OutDir>\dan.txt".
Cross-check detections vs inventory.csv / inventory.json (filename, SHA-256, attributes).
If you want this wrapped as a single Base64 one-liner you can paste directly into PowerShell (it recreates the file and runs it), I can deliver that too.
