$HoneyPotDirectoryNamePattern misses entries beginning with a period

[mol-tron]

I know this is more of a PowerShell bug, but thought I should bring it to your attention in case it could be fixed somehow. Some of my honeypot directory names begin with a period to also hide them from Macs in our mixed Windows/Mac environment.
Line 494 of FSRM-Anti-ransomware.ps1:
ForEach-Object -Process {Get-ChildItem -Path $_.Path -Force -ErrorAction SilentlyContinue -Directory -Filter $HoneyPotDirectoryNamePattern} |
When setting $HoneyPotDirectoryNamePattern to ??Directory, it does not match ones that begin with a period.
Example in straight PS:

PS C:\share2> Get-ChildItem -Path c:\share2 -Force -ErrorAction SilentlyContinue -Directory -Filter ??Directory??

    Directory: C:\share2

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       12/13/2019   2:51 PM                $$Directory 3
d-----       12/13/2019   2:58 PM                @@Directory 6
d-----       12/13/2019   2:51 PM                _!Directory 4
d-----       12/13/2019   2:53 PM                __Directory 5

Changing the filter to include any length beginning character with an asterisk will then show the missing directories

PS C:\share2> Get-ChildItem -Path c:\share2 -Force -ErrorAction SilentlyContinue -Directory -Filter *Directory??

    Directory: C:\share2

Mode                LastWriteTime         Length Name
----                -------------         ------ ----
d-----       12/13/2019   2:51 PM                $$Directory 3
d-----       12/13/2019   2:17 PM                .!Directory 1
d-----       12/13/2019   2:19 PM                .@Directory 7
d-----       12/13/2019   2:19 PM                ._Directory 2
d-----       12/13/2019   2:58 PM                @@Directory 6
d-----       12/13/2019   2:51 PM                _!Directory 4
d-----       12/13/2019   2:53 PM                __Directory 5

My workaround right now is to use *VerySpecificDirectoryName as $HoneyPotDirectoryNamePattern

[SparkyzCodez]

That's a good catch. I'll look into it and either update honey pot handling or blame it on PowerShell.

[SparkyzCodez]

Working towards a solution: I was testing doing a Get-ChildItem. I didn't realize that it could return more than one type. I'm an old C hack, a current Python hack, and I hate PowerShell so I don't expect this aberrant behavior. If I used a filter that returned only a single matching directory it was type System.IO.FileSystemInfo but if I had multiple hits it returned a type System.Array. Took me a stupid amount of time to figure out but I'm on the golden path now.

Now we'll cast our results as an array by doing something like this:
$result = @(Get-ChildItem -Filter ?asdf*)
$result += @(Get-ChildItem -Filter .asdf*)

The point of all this array casting is that we can't assume the number of hits the first Get-ChildItem will return, and by inference, the data type of the return. The second item's cast is just for belt and suspenders. I know exactly what data type I want so we'll be explicit in the code.

@("hoopdy","doo"). Take that ambiguity!
or @("um","kay")

Matching the honeypot directories that begin with a dot is a little weird. We can sometimes pretend the dot is an actual character, but not with wildcard matching. Other times it means this directory. And still other times it means, "Hey, everything after me is a file name extension and I'm just a place holder."

So why are we even bothering instead of just saying this is a special case that we are going to ignore? Macs and *nix, that's why. And because I hate PowerShell and love my Mac/Linux systems. Capricious? Sure. Will it hurt the non-Mac and non-Linux systems? Nope, they won't act any differently. And it's a challenge. That's why. Let's do this!

Steps to do - we tear into the actual script code and do four things:

1. create a flag variable that controls finding the dot
2. breakup up the pipelined code that gets the matching directories
3. check match-the-dot flag and take appropriate action
4. substring replace on the honey pot name pattern, replace '?' with '.'

Finally, this is really just a rambling note so that if I procrastinate I'll know where to pick this up later.

[SparkyzCodez]

No longer considering this a bug. It's really normal Windows behavior. I just don't like it so we're going to work around it.

[mol-tron]

Awesome, thanks! I'm sure I found the only character PowerShell doesn't like as a character to start a directory name and I always seem to run into obscure issues like this one. I'm not really a coder myself, just able to hack around existing code if needed.

[SparkyzCodez]

Testing new code.

[SparkyzCodez]

Added option to include honey pot directories that begin with a leading dot. Really great suggestion. Thanks.