skills/pbakaus_impeccable
1
0
Fork 0
mirror of https://github.com/pbakaus/impeccable.git synced 2026-09-17 08:36:25 +03:00
Code Issues Packages Projects Releases Wiki Activity

Remove hosted-runner exclusions for Defender reproduction

Browse Source 
Enable download and cloud protection, retain NeverSend sample consent, and record MAPS connectivity. No binaries are executed. AI-assisted under maintainer direction.
This commit is contained in:
Paul Bakaus
2026-09-05 11:16:37 -07:00
parent efb7c67ab0
commit 4dc2714566
1 changed files with 20 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/scan-windows-releases.ps1
+20 -2
View File
@@ -18,9 +18,11 @@ $failed = $false
try {
$before = Get-MpComputerStatus
$report.before = $before | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AMEngineVersion, AMProductVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated
$preferences = Get-MpPreference
$report.preferencesBefore = $preferences | Select-Object DisableRealtimeMonitoring, DisableIOAVProtection, DisableBehaviorMonitoring, MAPSReporting, SubmitSamplesConsent, ExclusionPath, ExclusionProcess, ExclusionExtension
if (-not $before.AMServiceEnabled) {
# Enabling an installed service is safe on this disposable runner. Never
# change exclusion, remediation, or cloud policies.
# weaken protection or change remediation policies.
Start-Service WinDefend
}
$mp = Get-ChildItem "$env:ProgramData\Microsoft\Windows Defender\Platform\*\MpCmdRun.exe" -ErrorAction SilentlyContinue |
@@ -36,13 +38,29 @@ try {
# Hosted images can default to real-time monitoring off. Enable it for the
# download-time reproduction and explicitly refuse to mislabel a scan if
# policy prevents activation. Never turn protection off.
Set-MpPreference -DisableRealtimeMonitoring $false
# The hosted image excludes both entire drives. Remove those existing
# exclusions on this disposable machine; never add any. Enable the checks
# a normal consumer install has, but keep automatic sample uploads off.
foreach ($excludedPath in @($preferences.ExclusionPath)) {
if ($excludedPath) { Remove-MpPreference -ExclusionPath $excludedPath }
}
foreach ($excludedProcess in @($preferences.ExclusionProcess)) {
if ($excludedProcess) { Remove-MpPreference -ExclusionProcess $excludedProcess }
}
foreach ($excludedExtension in @($preferences.ExclusionExtension)) {
if ($excludedExtension) { Remove-MpPreference -ExclusionExtension $excludedExtension }
}
Set-MpPreference -DisableRealtimeMonitoring $false -DisableIOAVProtection $false -DisableBehaviorMonitoring $false -MAPSReporting Advanced -SubmitSamplesConsent NeverSend
Start-Sleep -Seconds 3
$current = Get-MpComputerStatus
$report.scannerStatus = $current | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AMEngineVersion, AMProductVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated
if (-not $current.AMServiceEnabled -or -not $current.AntivirusEnabled) { throw 'Defender is not active; no scan verdict can be inferred.' }
if (-not $current.RealTimeProtectionEnabled) { throw 'Real-time monitoring remains disabled by runner policy; cannot reproduce download-time detection on this host.' }
$report.protectionPreferences = Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableIOAVProtection, DisableBehaviorMonitoring, MAPSReporting, SubmitSamplesConsent, ExclusionPath, ExclusionProcess, ExclusionExtension
$cloudOutput = & $mp -ValidateMapsConnection 2>&1 | Out-String
$report.cloudConnectionExitCode = $LASTEXITCODE
$cloudOutput | Set-Content (Join-Path $evidence 'cloud-connection.txt')
Write-Output $cloudOutput
$http = [System.Net.Http.HttpClient]::new()
$http.Timeout = [TimeSpan]::FromSeconds(90)
foreach ($sample in @(