osquery

function Remove-DenyWriteAcl {
  [CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact="Medium")]
  param(
    [string] $targetDir = ''
  )
  if($PSCmdlet.ShouldProcess($targetDir)){
    $acl = Get-Acl $targetDir
    $inheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
    $propagationFlag = [System.Security.AccessControl.PropagationFlags]::None
    $permType = [System.Security.AccessControl.AccessControlType]::Deny

    $permission = "everyone","write",$inheritanceFlag,$propagationFlag,$permType
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
    $acl.RemoveAccessRule($accessRule)
    $acl | Set-Acl $targetDir
  }
}

$progData =  [System.Environment]::GetEnvironmentVariable('ProgramData')
$targetFolder = Join-Path $progData "osquery"
$daemonFolder = Join-Path $targetFolder "osqueryd"

# Before we install, we check to see if the package is already installed
# as we need to remove the DenyWrite ACLs required by osqueryd, along with
# stopping the service.
if ((Get-Service "osqueryd" -ErrorAction SilentlyContinue) -and (Get-Service "osqueryd").Status -eq 'Running') {
  Stop-Service osqueryd
  Set-Service osqueryd -startuptype "manual"
  Get-CimInstance -ClassName Win32_Service -Filter "Name='osqueryd'" | Invoke-CimMethod -methodName Delete
}

if (Test-Path $daemonFolder) {
  Remove-DenyWriteAcl $daemonFolder
}

function Set-DenyWriteAcl {
  [CmdletBinding(SupportsShouldProcess=$true,ConfirmImpact="Medium")]
  param(
    [string] $targetDir = ''
  )
  if($PSCmdlet.ShouldProcess($targetDir)){
    $acl = Get-Acl $targetDir
    $inheritanceFlag = [System.Security.AccessControl.InheritanceFlags]::ContainerInherit -bor [System.Security.AccessControl.InheritanceFlags]::ObjectInherit
    $propagationFlag = [System.Security.AccessControl.PropagationFlags]::None
    $permType = [System.Security.AccessControl.AccessControlType]::Deny

    $permission = "everyone","write",$inheritanceFlag,$propagationFlag,$permType
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
    $acl.SetAccessRule($accessRule)
    $acl | Set-Acl $targetDir
  }
}

$packageName = 'osquery'
$url = 'https://osquery-packages.s3.amazonaws.com/choco/osquery-2.1.1.zip'
$progData =  [System.Environment]::GetEnvironmentVariable('ProgramData')
$targetFolder = Join-Path $progData "osquery"
$daemonFolder = Join-Path $targetFolder "osqueryd"

$packageArgs = @{
  packageName = $packageName
  url = $url
  unzipLocation = $targetFolder
  checkSum = 'BD95ECE4EC3C4E418275AB6B9DED61DD'
  checksumType = 'md5'
}

New-Item -Force -Type directory -Path $daemonFolder
Install-ChocolateyZipPackage @packageArgs

# In order to run osqueryd as a service, we need to have a folder that has a
# Deny Write ACL to everyone.
$targetDaemonBin = Join-Path $targetFolder "osqueryd.exe"
$destDaemonBin = Join-Path $daemonFolder "osqueryd.exe"
Move-Item -Force -Path $targetDaemonBin -Destination $destDaemonBin
Set-DenyWriteAcl $daemonFolder

# Add the osquery dir to the system path, to leverage osqueryi.exe
$oldPath = [System.Environment]::GetEnvironmentVariable('Path', 'Machine')
[System.Environment]::SetEnvironmentVariable('Path', "$oldPath;$targetFolder", 'Machine')

if (Test-Path $targetFolder) {
  Write-Output "osquery was successfully installed to $targetFolder."
} else {
  Write-Output 'There was an error installing osquery.'
}

$progData =  [System.Environment]::GetEnvironmentVariable('ProgramData')
$targetFolder = Join-Path $progData "osquery"

# Remove the osquery path from the System PATH variable. Note: Here
# we don't make use of our local vars, as Regex requires escaping the '\'
$oldPath = [System.Environment]::GetEnvironmentVariable('Path', 'Machine')
$newPath = $oldPath -replace ";C:\\ProgramData\\osquery",$NULL
[System.Environment]::SetEnvironmentVariable('Path', $newPath, 'Machine')

if (Test-Path $targetFolder) {
  Remove-Item -Force -Recurse $targetFolder
  if(Test-Path $targetFolder) {
    Write-Output 'osquery uninstallation was unsuccessful.'
  } else {
    Write-Output 'osquery was uninstalled successfully.'
  }
} else {
  Write-Output 'osquery was not found on the system. Nothing to do.'
}