diff --git a/login-notication.ps1 b/login-notication.ps1 new file mode 100644 index 0000000..6aa636a --- /dev/null +++ b/login-notication.ps1 @@ -0,0 +1,64 @@ +# ============================= +# LOGIN LOGGER +# ============================= + +# --- Initialization --- +$time = Get-Date -Format "yyyy-MM-dd HH:mm:ss" +$username = $env:USERNAME +$hostname = $env:COMPUTERNAME +$remoteIp = "Unknown" +$asnInfo = "" +$locationInfo = "" +$logPath = "C:\LOGIN-OUT-ALERT\log.txt" +$ntfyUrl = "" + +# --- Try to Get RDP Connection Info --- +try { + $queryOutput = query session + $activeLine = $queryOutput | Where-Object { $_ -match "$username" -and $_ -match "Active" } + + if ($activeLine) { + # Normalize spacing and extract session ID + $clean = $activeLine -replace '\s{2,}', ' ' + $parts = $clean.Split(' ') + $sessionId = $parts[2] + + # Find established remote connections on RDP port + $rdpConns = Get-NetTCPConnection -LocalPort 3389 -State Established + + foreach ($conn in $rdpConns) { + if ($conn.RemoteAddress -ne "127.0.0.1" -and $conn.RemoteAddress -ne "::1") { + $remoteIp = $conn.RemoteAddress + break + } + } + + # --- IP Info Lookup --- + if ($remoteIp -ne "Unknown") { + $ipInfo = Invoke-RestMethod -Uri "https://ipinfo.io/$remoteIp/json" + + if ($ipInfo) { + $asnInfo = $ipInfo.org + $locationInfo = "$($ipInfo.city), $($ipInfo.region), $($ipInfo.country)" + } + } + } + +} catch { + $remoteIp = "Error: $($_.Exception.Message)" +} + +# --- Construct Final Message --- +$eventMessage = @" +Time: [$time] +Who: $username logged into $hostname +From: $remoteIp +ASN: $asnInfo +Location: $locationInfo +"@ + +# --- Write to Log File --- +$eventMessage | Out-File $logPath -Append + +# --- Send to NTFY --- +Invoke-RestMethod -Uri $ntfyUrl -Method Post -Body $eventMessage diff --git a/logout-notication.ps1 b/logout-notication.ps1 new file mode 100644 index 0000000..17bef1c --- /dev/null +++ b/logout-notication.ps1 @@ -0,0 +1,4 @@ +$ntfyUrl = "" +$eventMessage = "Josh's Desktop has been logged out" # Default message +# Send HTTP request to ntfy +Invoke-RestMethod -Uri $ntfyUrl -Method Post -Body $eventMessage