677 lines
32 KiB
PowerShell
677 lines
32 KiB
PowerShell
#requires -Version 3.0 -Modules ConfigDefender, NetSecurity
|
|
|
|
<#
|
|
.SYNOPSIS
|
|
Bootstrap Microsoft Defender configuration
|
|
|
|
.DESCRIPTION
|
|
Bootstrap Microsoft Defender configuration, optimize and tweak Windows 10 protection and security
|
|
|
|
.PARAMETER CsvPath
|
|
The CSV with the configuration.
|
|
This is optional. Defaults are in the Script.
|
|
|
|
.PARAMETER Force
|
|
Enforce to apply the customize attack surface reduction rules
|
|
|
|
.EXAMPLE
|
|
PS C:\> .\Bootstrap-MicrosoftDefenderConfiguration.ps1
|
|
|
|
Bootstrap Microsoft Defender configuration, optimize and tweak Windows 10 Protection
|
|
|
|
.EXAMPLE
|
|
PS C:\> .\Bootstrap-MicrosoftDefenderConfiguration.ps1 -Verbose -Force
|
|
|
|
Bootstrap Microsoft Defender configuration, optimize and tweak Windows 10 Protection
|
|
|
|
.EXAMPLE
|
|
PS C:\> .\Bootstrap-MicrosoftDefenderConfiguration.ps1 -Verbose
|
|
|
|
Bootstrap Microsoft Defender configuration, optimize and tweak Windows 10 Protection
|
|
|
|
.LINK
|
|
https://docs.microsoft.com/en-us/powershell/module/defender/index?view=win10-ps
|
|
|
|
.LINK
|
|
https://github.com/jhochwald/PowerShell-collection/blob/master/Misc/Optimize-MicrosoftDefenderExclusions.ps1
|
|
|
|
.LINK
|
|
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-exploit-protection
|
|
|
|
.LINK
|
|
https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=win10-ps
|
|
|
|
.LINK
|
|
https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/customize-attack-surface-reduction
|
|
|
|
.LINK
|
|
https://support.microsoft.com/en-us/help/822158/virus-scanning-recommendations-for-enterprise-computers-that-are-runni
|
|
|
|
.LINK
|
|
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus
|
|
|
|
.LINK
|
|
https://demo.wd.microsoft.com/?ocid=cx-wddocs-testground
|
|
|
|
.NOTES
|
|
Please review the settings, please tweak the rules file (or modify the default rule set here)
|
|
|
|
You need to run this in an elevated PowerShell!
|
|
|
|
I use this during the bootstrap process of Windows systems.
|
|
Most of the settings here is also enforced by some of our Group Policies and we also have a lot of it configured via MDM CSPs (InTune).
|
|
|
|
This script is only a quick hack to harden (and secure) any new system, even if it is not managed afterwords.
|
|
#>
|
|
[CmdletBinding(ConfirmImpact = 'Low',
|
|
SupportsShouldProcess)]
|
|
param
|
|
(
|
|
[Parameter(ValueFromPipeline,
|
|
ValueFromPipelineByPropertyName)]
|
|
[Alias('RulesCsv')]
|
|
[string]
|
|
$CsvPath = '.\Bootstrap-MicrosoftDefenderConfiguration.csv',
|
|
[Parameter(ValueFromPipeline,
|
|
ValueFromPipelineByPropertyName)]
|
|
[Alias('EnforceRule')]
|
|
[switch]
|
|
$Force = $null
|
|
)
|
|
|
|
begin
|
|
{
|
|
# Create a new Mail Object
|
|
$AttackSurfaceReductionRuleList = @()
|
|
|
|
#region CsvHandler
|
|
if (Test-Path -Path $CsvPath -ErrorAction SilentlyContinue)
|
|
{
|
|
#region ImportCsv
|
|
Write-Verbose -Message ('Import the attack surface reduction settings from ' + $CsvPath)
|
|
$AttackSurfaceReductionRuleList = (Import-Csv -Path $CsvPath -Delimiter ',' -Encoding UTF8)
|
|
#endregion ImportCsv
|
|
}
|
|
else
|
|
{
|
|
#region DefaultCsv
|
|
Write-Verbose -Message 'Use the attack surface reduction default settings'
|
|
|
|
# Create a virtual CSV File (Quick hack: To keep it plain and simple to maintain)
|
|
$RuleDefaults = 'RuleID,RuleDescription,RuleAction
|
|
75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84, Block Office applications from injecting into other processes, Enabled
|
|
3B576869-A4EC-4529-8536-B80A7769E899, Block Office applications from creating executable content, Enabled
|
|
D4F940AB-401B-4EfC-AADC-AD5F3C50688A, Block Office applications from creating child processes, Enabled
|
|
D3E037E1-3EB8-44C8-A917-57927947596D, Impede JavaScript and VBScript to launch executable, Enabled
|
|
5BEB7EFE-FD9A-4556-801D-275E5FFC04CC, Block execution of potentially obfuscated script, Enabled
|
|
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550, Block executable content from email client and webmail, Enabled
|
|
92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B, Block Win32 imports from Macro code in Office, Enabled
|
|
c1db55ab-c21a-4637-bb3f-a12568109d35, Use advanced protection against ransomware, Enabled
|
|
9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2, Block credential stealing from the Windows local security authority subsystem (lsass.exe), Enabled
|
|
d1e49aac-8f56-4280-b9ba-993a6d77406c, Block process creations originating from PSExec and WMI commands, Enabled
|
|
b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4, Block untrusted and unsigned processes that run from USB, Enabled
|
|
26190899-1602-49e8-8b27-eb1d0a1ce869, Block Office communication applications from creating child processes, AuditMode
|
|
7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c, Block Adobe Reader from creating child processes, Enabled
|
|
e6db77e5-3df2-4cf1-b95a-636979351e5b, Block persistence through WMI event subscription, Enabled
|
|
01443614-cd74-433a-b99e-2ecdc07bfc25, Block executable files from running unless they meet a prevalence age or trusted list criteria, AuditMode'
|
|
|
|
# Import the virtual CSV File
|
|
$AttackSurfaceReductionRuleList = (ConvertFrom-Csv -InputObject $RuleDefaults -Delimiter ',')
|
|
#endregion DefaultCsv
|
|
}
|
|
#endregion CsvHandler
|
|
}
|
|
|
|
process
|
|
{
|
|
#region SetMpPreference
|
|
#region EnableNetworkProtection
|
|
Write-Verbose -Message 'Network protection helps to prevent employees from using any application to access dangerous domains that may host phishing scams, exploits, and other malicious content on the Internet'
|
|
$null = (Set-MpPreference -EnableNetworkProtection Enabled -Force -ErrorAction Continue)
|
|
#endregion EnableNetworkProtection
|
|
|
|
#region EnableControlledFolderAccess
|
|
Write-Verbose -Message 'Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware'
|
|
$null = (Set-MpPreference -EnableControlledFolderAccess Enabled -Force -ErrorAction Continue)
|
|
#endregion EnableControlledFolderAccess
|
|
|
|
#region SignatureScheduleDay
|
|
Write-Verbose -Message 'Specifies the day of the week on which to check for definition updates'
|
|
$null = (Set-MpPreference -SignatureScheduleDay Everyday -Force -ErrorAction Continue)
|
|
#endregion SignatureScheduleDay
|
|
|
|
#region SignatureScheduleTime
|
|
Write-Verbose -Message 'Specifies the time of day, as the number of minutes after midnight, to check for definition updates'
|
|
$null = (Set-MpPreference -SignatureScheduleTime 320 -Force -ErrorAction Continue)
|
|
#endregion SignatureScheduleTime
|
|
|
|
#region DisableArchiveScanning
|
|
Write-Verbose -Message 'Indicates whether to scan archive files for malicious and unwanted software'
|
|
$null = (Set-MpPreference -DisableArchiveScanning $true -Force -ErrorAction Continue)
|
|
#endregion DisableArchiveScanning
|
|
|
|
#region DisableAutoExclusions
|
|
Write-Verbose -Message 'Indicates whether to disable the Automatic Exclusions feature for the server'
|
|
$null = (Set-MpPreference -DisableAutoExclusions $false -Force -ErrorAction Continue)
|
|
#endregion DisableAutoExclusions
|
|
|
|
#region DisableBehaviorMonitoring
|
|
Write-Verbose -Message 'Indicates whether to enable behavior monitoring'
|
|
$null = (Set-MpPreference -DisableBehaviorMonitoring $true -Force -ErrorAction Continue)
|
|
#endregion DisableBehaviorMonitoring
|
|
|
|
#region DisableBlockAtFirstSeen
|
|
Write-Verbose -Message 'Indicates whether to enable block at first seen'
|
|
$null = (Set-MpPreference -DisableBlockAtFirstSeen $true -Force -ErrorAction Continue)
|
|
#endregion DisableBlockAtFirstSeen
|
|
|
|
#region DisableCatchupFullScan
|
|
Write-Verbose -Message 'Indicates whether Windows Defender runs catch-up scans for scheduled full scans'
|
|
$null = (Set-MpPreference -DisableCatchupFullScan $true -Force -ErrorAction Continue)
|
|
#endregion DisableCatchupFullScan
|
|
|
|
#region DisableCatchupQuickScan
|
|
Write-Verbose -Message 'Indicates whether Windows Defender runs catch-up scans for scheduled quick scans'
|
|
$null = (Set-MpPreference -DisableCatchupQuickScan $true -Force -ErrorAction Continue)
|
|
#endregion DisableCatchupQuickScan
|
|
|
|
#region DisableEmailScanning
|
|
Write-Verbose -Message 'Indicates whether Windows Defender parses the mailbox and mail files, according to their specific format, in order to analyze mail bodies and attachments'
|
|
$null = (Set-MpPreference -DisableEmailScanning $false -Force -ErrorAction Continue)
|
|
#endregion DisableEmailScanning
|
|
|
|
#region DisableIOAVProtection
|
|
Write-Verbose -Message 'Indicates whether Windows Defender scans all downloaded files and attachments (e.g. Downloads)'
|
|
$null = (Set-MpPreference -DisableIOAVProtection $true -Force -ErrorAction Continue)
|
|
#endregion DisableIOAVProtection
|
|
|
|
#region DisableIntrusionPreventionSystem
|
|
Write-Verbose -Message 'Indicates whether to configure network protection against exploitation of known vulnerabilities'
|
|
$null = (Set-MpPreference -DisableIntrusionPreventionSystem $false -Force -ErrorAction Continue)
|
|
#endregion DisableIntrusionPreventionSystem
|
|
|
|
#region DisablePrivacyMode
|
|
Write-Verbose -Message 'Indicates whether to disable privacy mode. Privacy mode prevents users, other than administrators, from displaying threat history'
|
|
$null = (Set-MpPreference -DisablePrivacyMode $false -Force -ErrorAction Continue)
|
|
#endregion DisablePrivacyMode
|
|
|
|
#region DisableRealtimeMonitoring
|
|
Write-Verbose -Message 'Indicates whether to use real-time protection'
|
|
$null = (Set-MpPreference -DisableRealtimeMonitoring $false -Force -ErrorAction Continue)
|
|
#endregion DisableRealtimeMonitoring
|
|
|
|
#region CheckForSignaturesBeforeRunningScan
|
|
Write-Verbose -Message 'Enable checking signatures before scanning'
|
|
$null = (Set-MpPreference -CheckForSignaturesBeforeRunningScan 1 -Force -ErrorAction Continue)
|
|
#endregion CheckForSignaturesBeforeRunningScan
|
|
|
|
#region DisableRemovableDriveScanning
|
|
Write-Verbose -Message 'Indicates whether to scan for malicious and unwanted software in removable drives, such as flash drives, during a full scan'
|
|
$null = (Set-MpPreference -DisableRemovableDriveScanning $true -Force -ErrorAction Continue)
|
|
#endregion DisableRemovableDriveScanning
|
|
|
|
#region DisableRestorePoint
|
|
Write-Verbose -Message 'Indicates whether to disable scanning of restore points'
|
|
$null = (Set-MpPreference -DisableRestorePoint $true -Force -ErrorAction Continue)
|
|
#endregion DisableRestorePoint
|
|
|
|
#region DisableScanningMappedNetworkDrivesForFullScan
|
|
Write-Verbose -Message 'Indicates whether to scan mapped network drives'
|
|
$null = (Set-MpPreference -DisableScanningMappedNetworkDrivesForFullScan $true -Force -ErrorAction Continue)
|
|
#endregion DisableScanningMappedNetworkDrivesForFullScan
|
|
|
|
#region DisableScanningNetworkFiles
|
|
Write-Verbose -Message 'Indicates whether to scan for network files'
|
|
$null = (Set-MpPreference -DisableScanningNetworkFiles $false -Force -ErrorAction Continue)
|
|
#endregion DisableScanningNetworkFiles
|
|
|
|
#region DisableScriptScanning
|
|
Write-Verbose -Message 'Specifies whether to disable the scanning of scripts during malware scans'
|
|
$null = (Set-MpPreference -DisableScriptScanning $false -Force -ErrorAction Continue)
|
|
#endregion DisableScriptScanning
|
|
|
|
#region HighThreatDefaultAction
|
|
Write-Verbose -Message 'Specifies which automatic remediation action to take for a high level threat'
|
|
$null = (Set-MpPreference -HighThreatDefaultAction Quarantine -Force -ErrorAction Continue)
|
|
#endregion HighThreatDefaultAction
|
|
|
|
#region LowThreatDefaultAction
|
|
Write-Verbose -Message 'Specifies which automatic remediation action to take for a low level threat'
|
|
$null = (Set-MpPreference -LowThreatDefaultAction Block -Force -ErrorAction Continue)
|
|
#endregion LowThreatDefaultAction
|
|
|
|
#region ModerateThreatDefaultAction
|
|
Write-Verbose -Message 'Specifies which automatic remediation action to take for a moderate level threat'
|
|
$null = (Set-MpPreference -ModerateThreatDefaultAction Quarantine -Force -ErrorAction Continue)
|
|
#endregion ModerateThreatDefaultAction
|
|
|
|
#region PUAProtection
|
|
Write-Verbose -Message 'Disable PUA Protection'
|
|
$null = (Set-MpPreference -PUAProtection Enabled -Force -ErrorAction Continue)
|
|
#endregion PUAProtection
|
|
|
|
#region QuarantinePurgeItemsAfterDelay
|
|
Write-Verbose -Message 'Specifies the number of days to keep items in the Quarantine folder'
|
|
$null = (Set-MpPreference -QuarantinePurgeItemsAfterDelay 30 -Force -ErrorAction Continue)
|
|
#endregion QuarantinePurgeItemsAfterDelay
|
|
|
|
#region RandomizeScheduleTaskTimes
|
|
Write-Verbose -Message 'Indicates whether to select a random time for the scheduled start and scheduled update for definitions'
|
|
$null = (Set-MpPreference -RandomizeScheduleTaskTimes $true -Force -ErrorAction Continue)
|
|
#endregion RandomizeScheduleTaskTimes
|
|
|
|
#region RealTimeScanDirection
|
|
Write-Verbose -Message 'Specifies scanning configuration for incoming and outgoing files on NTFS volumes'
|
|
$null = (Set-MpPreference -RealTimeScanDirection 0 -Force -ErrorAction Continue)
|
|
#endregion RealTimeScanDirection
|
|
|
|
#region RemediationScheduleDay
|
|
Write-Verbose -Message 'Specifies the day of the week on which to perform a scheduled full scan in order to complete remediation'
|
|
$null = (Set-MpPreference -RemediationScheduleDay Everyday -Force -ErrorAction Continue)
|
|
#endregion
|
|
|
|
#region RemediationScheduleTime
|
|
Write-Verbose -Message 'Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan'
|
|
$null = (Set-MpPreference -RemediationScheduleTime 120 -Force -ErrorAction Continue)
|
|
#endregion RemediationScheduleDay
|
|
|
|
#region ReportingAdditionalActionTimeOut
|
|
Write-Verbose -Message 'Specifies the number of minutes before a detection in the additional action state changes to the cleared state'
|
|
$null = (Set-MpPreference -ReportingAdditionalActionTimeOut 10080 -Force -ErrorAction Continue)
|
|
#endregion ReportingAdditionalActionTimeOut
|
|
|
|
#region ReportingCriticalFailureTimeOut
|
|
Write-Verbose -Message 'Specifies the number of minutes before a detection in the critically failed state changes to either the additional action state or the cleared state'
|
|
$null = (Set-MpPreference -ReportingCriticalFailureTimeOut 10080 -Force -ErrorAction Continue)
|
|
#endregion ReportingCriticalFailureTimeOut
|
|
|
|
#region ReportingNonCriticalTimeOut
|
|
Write-Verbose -Message 'Specifies the number of minutes before a detection in the non-critically failed state changes to the cleared state'
|
|
$null = (Set-MpPreference -ReportingNonCriticalTimeOut 11440 -Force -ErrorAction Continue)
|
|
#endregion ReportingNonCriticalTimeOut
|
|
|
|
#region ScanAvgCPULoadFactor
|
|
Write-Verbose -Message 'Specifies the maximum percentage CPU usage for a scan'
|
|
$null = (Set-MpPreference -ScanAvgCPULoadFactor 50 -Force -ErrorAction Continue)
|
|
#endregion ScanAvgCPULoadFactor
|
|
|
|
#region ScanOnlyIfIdleEnabled
|
|
Write-Verbose -Message 'Indicates whether to start scheduled scans only when the computer is not in use'
|
|
$null = (Set-MpPreference -ScanOnlyIfIdleEnabled $true -Force -ErrorAction Continue)
|
|
#endregion ScanOnlyIfIdleEnabled
|
|
|
|
#region ScanParameters
|
|
Write-Verbose -Message 'Specifies the scan type to use during a scheduled scan'
|
|
$null = (Set-MpPreference -ScanParameters 1 -Force -ErrorAction Continue)
|
|
#endregion ScanParameters
|
|
|
|
#region ScanPurgeItemsAfterDelay
|
|
Write-Verbose -Message 'Specifies the number of days to keep items in the scan history folder'
|
|
$null = (Set-MpPreference -ScanPurgeItemsAfterDelay 15 -Force -ErrorAction Continue)
|
|
#endregion ScanPurgeItemsAfterDelay
|
|
|
|
#region ScanScheduleDay
|
|
Write-Verbose -Message 'Specifies the day of the week on which to perform a scheduled scan'
|
|
$null = (Set-MpPreference -ScanScheduleDay Everyday -Force -ErrorAction Continue)
|
|
#endregion ScanScheduleDay
|
|
|
|
#region ScanScheduleQuickScanTime
|
|
Write-Verbose -Message 'Specifies the time of day, as the number of minutes after midnight, to perform a scheduled quick scan'
|
|
$null = (Set-MpPreference -ScanScheduleQuickScanTime 0 -Force -ErrorAction Continue)
|
|
#endregion ScanScheduleQuickScanTime
|
|
|
|
#region ScanScheduleTime
|
|
Write-Verbose -Message 'Specifies the time of day, as the number of minutes after midnight, to perform a scheduled scan'
|
|
$null = (Set-MpPreference -ScanScheduleTime 120 -Force -ErrorAction Continue)
|
|
#endregion ScanScheduleTime
|
|
|
|
#region SevereThreatDefaultAction
|
|
Write-Verbose -Message 'Specifies which automatic remediation action to take for a severe level threat'
|
|
$null = (Set-MpPreference -SevereThreatDefaultAction Quarantine -Force -ErrorAction Continue)
|
|
#endregion SevereThreatDefaultAction
|
|
|
|
#region SignatureAuGracePeriod
|
|
Write-Verbose -Message 'Specifies a grace period, in minutes, for the definition'
|
|
$null = (Set-MpPreference -SignatureAuGracePeriod 0 -Force -ErrorAction Continue)
|
|
#endregion SignatureAuGracePeriod
|
|
|
|
#region SignatureDisableUpdateOnStartupWithoutEngine
|
|
Write-Verbose -Message 'Indicates whether to initiate definition updates even if no antimalware engine is present'
|
|
$null = (Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $false -Force -ErrorAction Continue)
|
|
#endregion SignatureDisableUpdateOnStartupWithoutEngine
|
|
|
|
#region SignatureFirstAuGracePeriod
|
|
Write-Verbose -Message 'Specifies a grace period, in minutes, for the definition. If a definition successfully updates within this period, Windows Defender abandons any service initiated updates'
|
|
$null = (Set-MpPreference -SignatureFirstAuGracePeriod 120 -Force -ErrorAction Continue)
|
|
#endregion SignatureFirstAuGracePeriod
|
|
|
|
#region SignatureScheduleDay
|
|
Write-Verbose -Message 'Specifies the day of the week on which to check for definition updates'
|
|
$null = (Set-MpPreference -SignatureScheduleDay Everyday -Force -ErrorAction Continue)
|
|
#endregion SignatureScheduleDay
|
|
|
|
#region SignatureScheduleTime
|
|
Write-Verbose -Message 'Specifies the time of day, as the number of minutes after midnight, to check for definition updates'
|
|
$null = (Set-MpPreference -SignatureScheduleTime 165 -Force -ErrorAction Continue)
|
|
#endregion SignatureScheduleTime
|
|
|
|
#region SignatureUpdateCatchupInterval
|
|
Write-Verbose -Message 'Specifies the number of days after which Windows Defender requires a catch-up definition update'
|
|
$null = (Set-MpPreference -SignatureUpdateCatchupInterval 1 -Force -ErrorAction Continue)
|
|
#endregion SignatureUpdateCatchupInterval
|
|
|
|
#region SignatureUpdateInterval
|
|
Write-Verbose -Message 'Specifies the interval, in hours, at which to check for definition updates'
|
|
$null = (Set-MpPreference -SignatureUpdateInterval 12 -Force -ErrorAction Continue)
|
|
#endregion SignatureUpdateInterval
|
|
|
|
#region SubmitSamplesConsent
|
|
Write-Verbose -Message 'Specifies how Windows Defender checks for user consent for certain samples'
|
|
$null = (Set-MpPreference -SubmitSamplesConsent AlwaysPrompt -Force -ErrorAction Continue)
|
|
#endregion SubmitSamplesConsent
|
|
|
|
#region MAPSReporting MAPSReporting
|
|
Write-Verbose -Message 'Membership in Microsoft Active Protection Service Enable'
|
|
$null = (Set-MpPreference -MAPSReporting Advanced -Force -ErrorAction Continue)
|
|
#endregion MAPSReporting MAPSReporting
|
|
|
|
#region ThrottleLimit
|
|
Write-Verbose -Message 'Specifies the maximum number of concurrent operations that can be established to run the cmdlet'
|
|
$null = (Set-MpPreference -ThrottleLimit 0 -Force -ErrorAction Continue)
|
|
#endregion ThrottleLimit
|
|
|
|
#region UILockdown
|
|
Write-Verbose -Message 'Indicates whether to disable UI lock down mode'
|
|
$null = (Set-MpPreference -UILockdown $false -Force -ErrorAction Continue)
|
|
#endregion UILockdown
|
|
|
|
#region UnknownThreatDefaultAction
|
|
Write-Verbose -Message 'Specifies which automatic remediation action to take for an unknown level threat'
|
|
$null = (Set-MpPreference -UnknownThreatDefaultAction Block -Force -ErrorAction Continue)
|
|
#endregion UnknownThreatDefaultAction
|
|
|
|
#region SignatureFallbackOrder
|
|
Write-Verbose -Message 'Specifies the order in which to contact different definition update sources.'
|
|
$null = (Set-MpPreference -SignatureFallbackOrder 'MicrosoftUpdateServer | MMPC' -Force -ErrorAction Continue)
|
|
#endregion SignatureFallbackOrder
|
|
|
|
#region ControlledFolderAccessAllowedApplications
|
|
Write-Verbose -Message 'Setup the Controlled Folder Access Allowed Applications'
|
|
|
|
# Define a list of Applications to exclude - Fully Qualified
|
|
<#
|
|
I like to keep this list as short as possible
|
|
#>
|
|
$NewControlledFolderAccessAllowedApplications = @(
|
|
"$env:windir\System32\taskhostw.exe"
|
|
)
|
|
|
|
# Create a new Object
|
|
$AllControlledFolderAccessAllowedApplications = (New-Object -TypeName System.Collections.Generic.List[System.Object])
|
|
|
|
# Get the existing exclusions
|
|
$AllControlledFolderAccessAllowedApplications.Add((Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ControlledFolderAccessAllowedApplications))
|
|
|
|
#region NewControlledFolderAccessAllowedApplicationsLoop
|
|
foreach ($NewControlledFolderAccessAllowedApplication in $NewControlledFolderAccessAllowedApplications)
|
|
{
|
|
if ($AllControlledFolderAccessAllowedApplications -notcontains $NewControlledFolderAccessAllowedApplication)
|
|
{
|
|
Write-Verbose -Message ('Add ' + $NewControlledFolderAccessAllowedApplication + ' to the Controlled Folder Access Allowed Applications list')
|
|
|
|
$AllControlledFolderAccessAllowedApplications.Add($NewControlledFolderAccessAllowedApplication)
|
|
}
|
|
}
|
|
#endregion NewControlledFolderAccessAllowedApplicationsLoop
|
|
|
|
# Make sure we have nothing doubled
|
|
$AllControlledFolderAccessAllowedApplications = ($AllControlledFolderAccessAllowedApplications | Sort-Object -Unique)
|
|
|
|
# Apply the new exclusion list. This will replace the complete list.
|
|
Write-Verbose -Message 'Apply the new Controlled Folder Access Allowed Applications list'
|
|
|
|
$null = (Set-MpPreference -ControlledFolderAccessAllowedApplications $AllControlledFolderAccessAllowedApplications -Force -ErrorAction Continue)
|
|
#endregion ControlledFolderAccessAllowedApplications
|
|
|
|
#region ExclusionPath
|
|
# Define a list of Applications to exclude - Fully Qualified
|
|
$NewExclusionPathList = @(
|
|
"$env:windir\SoftwareDistribution\DataStore\Datastore.edb",
|
|
"$env:windir\SoftwareDistribution\DataStore\Logs\Edb*.jrs",
|
|
"$env:windir\SoftwareDistribution\DataStore\Logs\Edb.chk",
|
|
"$env:windir\SoftwareDistribution\DataStore\Logs\Tmp.edb",
|
|
"$env:windir\Security\Database\*.edb",
|
|
"$env:windir\Security\Database\*.sdb",
|
|
"$env:windir\Security\Database\*.log",
|
|
"$env:windir\Security\Database\*.chk",
|
|
"$env:windir\Security\Database\*.jrs",
|
|
"$env:windir\Security\Database\*.xml",
|
|
"$env:windir\Security\Database\*.csv",
|
|
"$env:windir\Security\Database\*.cmtx",
|
|
"$env:ProgramData\ntuser.pol",
|
|
"$env:windir\System32\GroupPolicy\Machine\Registry.pol",
|
|
"$env:windir\System32\GroupPolicy\Machine\Registry.tmp",
|
|
"$env:windir\System32\GroupPolicy\User\Registry.pol",
|
|
"$env:windir\System32\GroupPolicy\User\Registry.tmp"
|
|
)
|
|
|
|
# Create a new Object
|
|
$AllExclusionPath = (New-Object -TypeName System.Collections.Generic.List[System.Object])
|
|
|
|
# Get the existing exclusions
|
|
$AllExclusionPath.Add((Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionPath))
|
|
|
|
#region NewExclusionPathLoop
|
|
foreach ($NewExclusionPath in $NewExclusionPathList)
|
|
{
|
|
if ($AllExclusionPath -notcontains $NewExclusionPath)
|
|
{
|
|
Write-Verbose -Message ('Add ' + $NewExclusionPath + ' as path to exclude')
|
|
|
|
$AllExclusionPath.Add($NewExclusionPath)
|
|
}
|
|
}
|
|
#endregion NewExclusionPathLoop
|
|
|
|
# Make sure we have nothing doubled
|
|
$AllExclusionPath = ($AllExclusionPath | Sort-Object -Unique)
|
|
|
|
# Apply the new exclusion list. This will replace the complete list.
|
|
Write-Verbose -Message 'Apply the new Path to exclude list'
|
|
|
|
$null = (Set-MpPreference -ExclusionPath $AllExclusionPath -Force -ErrorAction Continue)
|
|
#endregion ExclusionPath
|
|
|
|
#region ExclusionProcess
|
|
# Define a list of Applications to exclude - Fully Qualified
|
|
$NewExclusionProcessList = @(
|
|
"$env:windir\System32\svchost.exe",
|
|
"$env:windir\System32\wuauclt.exe"
|
|
)
|
|
|
|
# Create a new Object
|
|
$AllExclusionProcess = (New-Object -TypeName System.Collections.Generic.List[System.Object])
|
|
|
|
# Get the existing exclusions
|
|
$AllExclusionProcess.Add((Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty ExclusionProcess))
|
|
|
|
#region NewExclusionProcessLoop
|
|
foreach ($NewExclusionProcess in $NewExclusionProcessList)
|
|
{
|
|
if ($AllExclusionProcess -notcontains $NewExclusionProcess)
|
|
{
|
|
Write-Verbose -Message ('Add ' + $NewExclusionProcess + ' as process to exclude')
|
|
|
|
$AllExclusionProcess.Add($NewExclusionProcess)
|
|
}
|
|
}
|
|
#endregion NewExclusionProcessLoop
|
|
|
|
# Make sure we have nothing doubled
|
|
$AllExclusionProcess = ($AllExclusionProcess | Sort-Object -Unique)
|
|
|
|
# Apply the new exclusion list. This will replace the complete list.
|
|
Write-Verbose -Message 'Apply the new Process to exclude list'
|
|
|
|
$null = (Set-MpPreference -ExclusionProcess $AllExclusionProcess -Force -ErrorAction Continue)
|
|
#endregion ExclusionProcess
|
|
#endregion SetMpPreference
|
|
|
|
#region ProcessMitigation
|
|
# Local Process Mitigation file
|
|
$ProcessMitigationFile = '.\ProcessMitigation.xml'
|
|
|
|
# Check if we have a local Process Mitigation file
|
|
if (-not (Test-Path -Path $ProcessMitigationFile -ErrorAction SilentlyContinue))
|
|
{
|
|
# Where to download the XML File?
|
|
$ProcessMitigationUri = 'https://demo.wd.microsoft.com/Content/ProcessMitigation.xml'
|
|
|
|
Write-Verbose -Message ('Downloading Process Mitigation file from ' + $ProcessMitigationUri)
|
|
|
|
# Download
|
|
$paramInvokeWebRequest = @{
|
|
Uri = $ProcessMitigationUri
|
|
OutFile = $ProcessMitigationFile
|
|
Method = 'Get'
|
|
ContentType = 'text/xml'
|
|
ErrorAction = 'Continue'
|
|
}
|
|
$null = (Invoke-WebRequest @paramInvokeWebRequest)
|
|
}
|
|
|
|
if (Test-Path -Path $ProcessMitigationFile -ErrorAction SilentlyContinue)
|
|
{
|
|
Write-Verbose -Message 'Enabling Exploit Protection'
|
|
|
|
# Apply the File
|
|
$null = (Set-ProcessMitigation -PolicyFilePath $ProcessMitigationFile -ErrorAction Continue)
|
|
|
|
# Cleanup
|
|
$paramRemoveItem = @{
|
|
Path = $ProcessMitigationFile
|
|
Force = $true
|
|
Confirm = $false
|
|
ErrorAction = 'Continue'
|
|
}
|
|
$null = (Remove-Item @paramRemoveItem)
|
|
}
|
|
else
|
|
{
|
|
Write-Warning -Message ('The local Process Mitigation file (' + $ProcessMitigationFile + ') is missing! Not enabling Exploit Protection.')
|
|
}
|
|
#endregion ProcessMitigation
|
|
|
|
#region WindowsDefenderSandbox
|
|
Write-Verbose -Message 'Turn on Windows Defender Sandbox'
|
|
$null = ([Environment]::SetEnvironmentVariable('MP_FORCE_USE_SANDBOX', 1, 'Machine'))
|
|
#endregion WindowsDefenderSandbox
|
|
|
|
#region AttackSurfaceReduction
|
|
#region GetAttackSurfaceReductionRulesIds
|
|
$AttackSurfaceReductionRulesIds = (Get-MpPreference -ErrorAction SilentlyContinue | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids)
|
|
#endregion GetAttackSurfaceReductionRulesIds
|
|
|
|
Write-Verbose -Message 'Enabling Attack Surface Reduction rules'
|
|
|
|
#region SetMpPreferenceDefaults
|
|
$AddMpPreferenceParameters = @{
|
|
ErrorAction = 'Stop'
|
|
Force = $true
|
|
}
|
|
#endregion SetMpPreferenceDefaults
|
|
|
|
#region RuleLoop
|
|
foreach ($AttackSurfaceReductionRule in $AttackSurfaceReductionRuleList)
|
|
{
|
|
#region SingleLoop
|
|
try
|
|
{
|
|
if (($Force) -or ($AttackSurfaceReductionRulesIds -notcontains $AttackSurfaceReductionRule.RuleID))
|
|
{
|
|
#region AppleTheRuleValue
|
|
Write-Verbose -Message ('Set ' + $AttackSurfaceReductionRule.RuleDescription + ' to ' + $AttackSurfaceReductionRule.RuleAction)
|
|
|
|
# Add some values
|
|
$AddMpPreferenceParameters.AttackSurfaceReductionRules_Ids = $AttackSurfaceReductionRule.RuleID
|
|
$AddMpPreferenceParameters.AttackSurfaceReductionRules_Actions = $AttackSurfaceReductionRule.RuleAction
|
|
|
|
# Apply the Rule
|
|
$null = (Add-MpPreference @AddMpPreferenceParameters)
|
|
#endregion AppleTheRuleValue
|
|
}
|
|
}
|
|
catch
|
|
{
|
|
#region ErrorHandler
|
|
# get error record
|
|
[Management.Automation.ErrorRecord]$e = $_
|
|
|
|
# retrieve information about runtime error
|
|
$info = [PSCustomObject]@{
|
|
Exception = $e.Exception.Message
|
|
Reason = $e.CategoryInfo.Reason
|
|
Target = $e.CategoryInfo.TargetName
|
|
Script = $e.InvocationInfo.ScriptName
|
|
Line = $e.InvocationInfo.ScriptLineNumber
|
|
Column = $e.InvocationInfo.OffsetInLine
|
|
}
|
|
|
|
$info | Out-String | Write-Verbose
|
|
|
|
Write-Warning -Message ('Unable to enable to Rule: ' + $AttackSurfaceReductionRule.RuleID + ' (' + $AttackSurfaceReductionRule.RuleDescription + ')')
|
|
#endregion ErrorHandler
|
|
}
|
|
#endregion SingleLoop
|
|
}
|
|
#endregion RuleLoop
|
|
#endregion AttackSurfaceReduction
|
|
|
|
#region ReloadRegistry
|
|
& "$env:windir\system32\rundll32.exe" USER32.DLL, UpdatePerUserSystemParameters , 1 , True
|
|
#endregion ReloadRegistry
|
|
|
|
#region EnableFirewall
|
|
Write-Verbose -Message 'Enable the Windows Firewall for all Profiles - Set the default to block everything'
|
|
$null = (Set-NetFirewallProfile -Profile Domain, Public, Private -Enabled True -DefaultInboundAction Block -LogBlocked True -Confirm:$false -ErrorAction Continue)
|
|
#endregion EnableFirewall
|
|
}
|
|
|
|
end
|
|
{
|
|
#region UpdateSignature
|
|
Write-Verbose -Message 'Update Defender'
|
|
$null = (Update-MpSignature)
|
|
#endregion UpdateSignature
|
|
}
|
|
|
|
#region LICENSE
|
|
<#
|
|
BSD 3-Clause License
|
|
|
|
Copyright (c) 2021, enabling Technology
|
|
All rights reserved.
|
|
|
|
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
|
|
|
|
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
|
|
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
|
|
3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
|
|
|
|
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
#>
|
|
#endregion LICENSE
|
|
|
|
#region DISCLAIMER
|
|
<#
|
|
DISCLAIMER:
|
|
- Use at your own risk, etc.
|
|
- This is open-source software, if you find an issue try to fix it yourself. There is no support and/or warranty in any kind
|
|
- This is a third-party Software
|
|
- The developer of this Software is NOT sponsored by or affiliated with Microsoft Corp (MSFT) or any of its subsidiaries in any way
|
|
- The Software is not supported by Microsoft Corp (MSFT)
|
|
- By using the Software, you agree to the License, Terms, and any Conditions declared and described above
|
|
- If you disagree with any of the terms, and any conditions declared: Just delete it and build your own solution
|
|
#>
|
|
#endregion DISCLAIMER
|