Skip to content

Commit

Permalink
Minor Update
Browse files Browse the repository at this point in the history
[+] Add checks for Microsoft Defender exclusions
[+] Add checks for Microsoft Defender ASR exclusions
[+] Add BitLocker encryption method
[*] Update RecommendedValue for ID 1762
[*] Fix title of ID 18.9.11.4.1
[*] Reorder 0x6d69636b lists
  • Loading branch information
0x6d69636b committed May 3, 2021
1 parent eaa23f4 commit 9612f96
Show file tree
Hide file tree
Showing 4 changed files with 130 additions and 88 deletions.
33 changes: 33 additions & 0 deletions Invoke-HardeningKitty.ps1
Original file line number Diff line number Diff line change
Expand Up @@ -881,6 +881,39 @@
}
}

#
# Microsoft Defender Preferences - Exclusion lists
# The values are saved from a PowerShell function into an object.
# The desired arguments can be accessed directly.
#
ElseIf ($Finding.Method -eq 'MpPreferenceExclusion') {

# Check if the user has admin rights, skip test if not
# Normal users are not allowed to get exclusions
If (-not($IsAdmin)) {
$StatsError++
$Message = "ID "+$Finding.ID+", "+$Finding.Name+", Method "+$Finding.Method+" requires admin priviliges. Test skipped."
Write-ProtocolEntry -Text $Message -LogLevel "Error"
Continue
}

try {

$ResultOutput = Get-MpPreference
$ExclusionType = $Finding.MethodArgument
$ResultExclusions = $ResultOutput.$ExclusionType

ForEach ($Exclusion in $ResultExclusions) {
$Result += $Exclusion+";"
}
# Remove last character
$Result = $Result -replace .$

} catch {
$Result = $Finding.DefaultValue
}
}

#
# Exploit protection (System)
# The values are saved from a PowerShell function into an object.
Expand Down
Loading

0 comments on commit 9612f96

Please sign in to comment.