From efb7c67ab06ebe75d356c8f5cc9fb745badf93d3 Mon Sep 17 00:00:00 2001 From: Paul Bakaus Date: Sat, 5 Sep 2026 11:14:29 -0700 Subject: [PATCH] Verify Defender real-time protection during sample download The first on-demand scans found no threats, but the runner defaulted to real-time monitoring off. Explicitly enable and verify it before comparing download-time behavior. AI-assisted under maintainer direction. --- scripts/scan-windows-releases.ps1 | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/scripts/scan-windows-releases.ps1 b/scripts/scan-windows-releases.ps1 index 99de30426..a4f1d18c1 100644 --- a/scripts/scan-windows-releases.ps1 +++ b/scripts/scan-windows-releases.ps1 @@ -20,7 +20,7 @@ try { $report.before = $before | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AMEngineVersion, AMProductVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated if (-not $before.AMServiceEnabled) { # Enabling an installed service is safe on this disposable runner. Never - # change exclusion, remediation, cloud, or real-time protection policies. + # change exclusion, remediation, or cloud policies. Start-Service WinDefend } $mp = Get-ChildItem "$env:ProgramData\Microsoft\Windows Defender\Platform\*\MpCmdRun.exe" -ErrorAction SilentlyContinue | @@ -33,9 +33,16 @@ try { $updateOutput | Set-Content (Join-Path $evidence 'signature-update.txt') Write-Output $updateOutput if ($report.signatureUpdateExitCode -ne 0) { throw 'Defender signature update failed; cannot claim a current-definition scan.' } + # Hosted images can default to real-time monitoring off. Enable it for the + # download-time reproduction and explicitly refuse to mislabel a scan if + # policy prevents activation. Never turn protection off. + Set-MpPreference -DisableRealtimeMonitoring $false + Start-Sleep -Seconds 3 $current = Get-MpComputerStatus $report.scannerStatus = $current | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AMEngineVersion, AMProductVersion, AntivirusSignatureVersion, AntivirusSignatureLastUpdated if (-not $current.AMServiceEnabled -or -not $current.AntivirusEnabled) { throw 'Defender is not active; no scan verdict can be inferred.' } + if (-not $current.RealTimeProtectionEnabled) { throw 'Real-time monitoring remains disabled by runner policy; cannot reproduce download-time detection on this host.' } + $report.protectionPreferences = Get-MpPreference | Select-Object DisableRealtimeMonitoring, DisableIOAVProtection, DisableBehaviorMonitoring, MAPSReporting, SubmitSamplesConsent, ExclusionPath, ExclusionProcess, ExclusionExtension $http = [System.Net.Http.HttpClient]::new() $http.Timeout = [TimeSpan]::FromSeconds(90) foreach ($sample in @(