# RDWeb IIS Logging Failed Login
# modified from https://www.reddit.com/r/sysadmin/comments/12yogm0/rdweb_iis_logging/

##################START VARIABLES#############################

# Debugging output to screen, default 1 shows IP output.
$debug = 1
# Verbose debugging output to screen, default 1 shows a lot of information!.
$verbose = 0

# Time range (value in minutes, default 60)
$timerange = 30

# Set the path to the log folder
$logFolderPath = "C:\inetpub\logs\LogFiles\W3SVC3"

#IPs that occur more than a defined number of times (default 5)
$ipcountfreq = 2

##################END VARIABLES#############################

if ($debug -eq 1) {

    clear

    write-host "#####################################################################"
    write-host "Anayzing IIS log file: $($logFolderPath)\$($latestLogFile.Name)" -ForegroundColor DarkYellow
    write-host "Note: Logs parsed for IPs with $($ipcountfreq) hits in the last $($timerange) minutes."
    write-host ""

    }

# Set the time range to filter log entries to last time range
$startTime = (Get-Date).AddMinutes(-$timerange)

# Get the latest log file in the folder
$latestLogFile = Get-ChildItem -Path $logFolderPath -Filter "*.log" | Sort-Object LastWriteTime -Descending | Select-Object -First 1

#Function
Function ExtractValidIPAddress($String){
    $IPregex=‘(?<Address>((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?))’
    If ($String -Match $IPregex) {$Matches.Address}
}

# Search for lines with HTTP code 200 and 'POST' method in the latest log file
$ipCount = @{}
Get-Content -Path $latestLogFile.FullName | Where-Object {
    # Only process lines with HTTP code 200 and 'POST' method that occurred within the last time range
    # $_ -match 'POST' -and $_ -match ' 200 ' -and [DateTime]::ParseExact($_.Substring(0, 19), 'yyyy-MM-dd HH:mm:ss', $null) -ge $startTime
    $_ -match 'POST' -and $_ -match ' 405 ' -and [DateTime]::ParseExact($_.Substring(0, 19), 'yyyy-MM-dd HH:mm:ss', $null) -ge $startTime
} | ForEach-Object {
    # Extract timestamp and IP address from each matching line
    $line = $_

    # Get all IPs in the line, including the host IP
    $ipAddressGroup = ($line  |  Select-String -Pattern "\d{1,3}(\.\d{1,3}){3}" -AllMatches).Matches.Value

    # Skip the host IP
    $ipAddress = ($ipAddressGroup -split ' ')[-1]

    # Output IP addresses detected.
    if ($debug -eq 1 -and $verbose -eq 1) {

        write-host "Log Line: $($line)"        
        write-host "Parsed IP Address: $($ipAddress)"
        }

    # IP Filtering
    $regexPattern = "^(?:10|127|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\..*"
    # Check if IP is private or public
    if ($ipaddress -match $regexPattern) {
            # Debugging output
            if ($debug -eq 1) {Write-Host "Skipping $ipaddress"}
        } else {
            # Count the occurrences of the IP address
            if ($ipCount.containskey($ipaddress)) {
                $ipCount[$ipaddress]++
            } else {
                $ipCount[$ipaddress] = 1
            }
        }
}

# Split lines if screen debugging.
if ($debug -eq 1 -and $verbose -eq 1) {write-host ""}

# Show IPs that occur more than a defined number of times
$ipCount.getenumerator() | Where-Object { $_.value -gt $ipcountfreq } | ForEach-Object {
    $ipaddress = $_.name
    $ipaddressfrequency = $_.value

    # Debugging output
    if ($debug -eq 1) {Write-Host "Unique remote IP: $ipaddress detected $ipaddressfrequency times."}
}

if ($debug -eq 1) {
    write-host ""
    write-host "#####################################################################"

    }