Securite moderne¶

# Query VBS and Device Guard status in a single call
Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
    Select-Object VirtualizationBasedSecurityStatus,
                  SecurityServicesRunning,
                  SecurityServicesConfigured,
                  RequiredSecurityProperties |
    Format-List

# Enable VBS with Secure Boot requirement
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" `
    -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord

# Require Secure Boot only (value 1) or Secure Boot + DMA (value 3)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" `
    -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord

# Check VBS status via WMI
$dg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard

switch ($dg.VirtualizationBasedSecurityStatus) {
    0 { "VBS is not enabled" }
    1 { "VBS is enabled but not running" }
    2 { "VBS is running" }
}

# Enable Credential Guard without UEFI lock (recommended for testing)
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
    -Name "LsaCfgFlags" -Value 2 -Type DWord

# Also enable LSA protection (PPL) as defense in depth
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" `
    -Name "RunAsPPL" -Value 1 -Type DWord

# VBS must also be enabled
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard" `
    -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord

# Verify Credential Guard is running
$dg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
if ($dg.SecurityServicesRunning -contains 1) {
    "Credential Guard is active"
} else {
    "Credential Guard is NOT active"
}

# Check LSA protection mode
$lsa = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -ErrorAction SilentlyContinue
"LsaCfgFlags: $($lsa.LsaCfgFlags)"
"RunAsPPL: $($lsa.RunAsPPL)"

# Check current CI policy enforcement mode
$ci = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\CI" -ErrorAction SilentlyContinue
if ($ci.UMCIAuditMode -eq 1) {
    "WDAC is in AUDIT mode (logging only, not blocking)"
} else {
    "WDAC is in ENFORCEMENT mode (blocking unauthorized code)"
}

# View recent WDAC audit events
Get-WinEvent -LogName "Microsoft-Windows-CodeIntegrity/Operational" -MaxEvents 20 |
    Where-Object { $_.Id -in @(3076, 3077, 3089) } |
    Format-Table TimeCreated, Id, Message -Wrap

# Create the Scenarios subkey if it does not exist
$path = "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity"
if (-not (Test-Path $path)) {
    New-Item -Path $path -Force | Out-Null
}

# Enable HVCI without UEFI lock
Set-ItemProperty -Path $path -Name "Enabled" -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name "Locked" -Value 0 -Type DWord

# Check HVCI compatibility of loaded drivers
$dg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
"HVCI Status: $($dg.SecurityServicesRunning -contains 2)"

# List drivers that may be incompatible with HVCI
$drivers = driverquery /v /fo csv | ConvertFrom-Csv
$drivers | Where-Object { $_."Is Signed" -eq "FALSE" } | Format-Table "Module Name", "Display Name", "Is Signed"

# Check Secure Boot status via registry
$sb = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" -ErrorAction SilentlyContinue
if ($sb.UEFISecureBootEnabled -eq 1) {
    "Secure Boot is ENABLED"
} else {
    "Secure Boot is DISABLED or not supported"
}

# Alternative: use the Confirm-SecureBootUEFI cmdlet
try {
    $result = Confirm-SecureBootUEFI
    "Secure Boot UEFI confirmation: $result"
} catch {
    "Secure Boot not supported on this system"
}

# Check TPM status via registry
$tpm = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Tpm" -ErrorAction SilentlyContinue
"TPM Present: $($tpm.TpmPresent)"
"TPM Ready: $($tpm.TpmReady)"
"TPM Enabled: $($tpm.TpmEnabled)"

# Detailed TPM information via WMI
Get-CimInstance -Namespace "root\cimv2\Security\MicrosoftTpm" -ClassName Win32_Tpm |
    Select-Object IsActivated_InitialValue, IsEnabled_InitialValue, IsOwned_InitialValue,
                  ManufacturerIdTxt, ManufacturerVersion, SpecVersion |
    Format-List

# Check BitLocker status on all volumes
Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, ProtectionStatus,
    EncryptionMethod, EncryptionPercentage, KeyProtector | Format-List

# View FVE policy registry values
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\FVE" -ErrorAction SilentlyContinue |
    Select-Object -Property * -ExcludeProperty PS* | Format-List

# List all Defender exclusions
$exBase = "HKLM:\SOFTWARE\Microsoft\Windows Defender\Exclusions"
"=== Path exclusions ==="
Get-ItemProperty "$exBase\Paths" -ErrorAction SilentlyContinue |
    Select-Object -Property * -ExcludeProperty PS*
"=== Extension exclusions ==="
Get-ItemProperty "$exBase\Extensions" -ErrorAction SilentlyContinue |
    Select-Object -Property * -ExcludeProperty PS*
"=== Process exclusions ==="
Get-ItemProperty "$exBase\Processes" -ErrorAction SilentlyContinue |
    Select-Object -Property * -ExcludeProperty PS*

# Enable LSASS credential theft protection in audit mode
$rulesPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules"
if (-not (Test-Path $rulesPath)) {
    New-Item -Path $rulesPath -Force | Out-Null
}

# Set LSASS protection rule to audit mode (value 2)
Set-ItemProperty -Path $rulesPath `
    -Name "9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2" -Value "2" -Type String

# List all configured ASR rules
Get-ItemProperty $rulesPath -ErrorAction SilentlyContinue |
    Select-Object -Property * -ExcludeProperty PS*

# View current exploit protection settings for a specific process
Get-ProcessMitigation -Name notepad.exe

# Enable DEP and CFG for a specific process
Set-ProcessMitigation -Name notepad.exe -Enable DEP, CFG

# Enable ASLR (ForceRelocateImages) for a specific process
Set-ProcessMitigation -Name notepad.exe -Enable ForceRelocateImages

# View the system-wide defaults
Get-ProcessMitigation -System

# Read the raw MitigationOptions for a process
$ifeoPath = "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe"
$mitigation = Get-ItemProperty $ifeoPath -Name "MitigationOptions" -ErrorAction SilentlyContinue
if ($mitigation) {
    "MitigationOptions (hex): " + [BitConverter]::ToString($mitigation.MitigationOptions)
} else {
    "No custom MitigationOptions set for this process"
}

# Check PPL status of a service
$svc = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\WinDefend" -ErrorAction SilentlyContinue
switch ($svc.LaunchProtected) {
    0 { "WinDefend: No PPL protection" }
    1 { "WinDefend: Windows PPL" }
    2 { "WinDefend: Windows Light PPL" }
    3 { "WinDefend: Antimalware Light PPL" }
    4 { "WinDefend: LSA Light PPL" }
}

# Check LSASS protection
$lsa = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -ErrorAction SilentlyContinue
"LSASS RunAsPPL: $($lsa.RunAsPPL)"

# Enable auditing for registry object access
auditpol /set /subcategory:"Registry" /success:enable /failure:enable

# Verify the current audit policy
auditpol /get /subcategory:"Registry"

# Add an audit rule to track write attempts by everyone on a specific key
$acl = Get-Acl "HKLM:\SOFTWARE\MonApp"

$auditRule = New-Object System.Security.AccessControl.RegistryAuditRule(
    "Everyone",                          # Who to audit
    "SetValue,CreateSubKey,Delete",      # What operations
    "ContainerInherit,ObjectInherit",    # Inheritance
    "None",                              # Propagation
    "Success,Failure"                    # Audit on success, failure, or both
)

$acl.AddAuditRule($auditRule)
Set-Acl "HKLM:\SOFTWARE\MonApp" $acl

# Search for recent registry audit events
Get-WinEvent -FilterHashtable @{
    LogName = "Security"
    Id = @(4656, 4657, 4663)
} -MaxEvents 20 | Format-Table TimeCreated, Id, Message -Wrap

# Full VBS diagnostic
$dg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
"VBS Status: $($dg.VirtualizationBasedSecurityStatus)"
"Available security properties: $($dg.AvailableSecurityProperties -join ', ')"
"Required security properties: $($dg.RequiredSecurityProperties -join ', ')"
"Services configured: $($dg.SecurityServicesConfigured -join ', ')"
"Services running: $($dg.SecurityServicesRunning -join ', ')"

# Comprehensive modern security diagnostic script
Write-Host "=== VBS Status ===" -ForegroundColor Cyan
$dg = Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard
"VBS: $($dg.VirtualizationBasedSecurityStatus) (0=off, 1=configured, 2=running)"
"Services running: $($dg.SecurityServicesRunning -join ', ') (1=CredGuard, 2=HVCI)"

Write-Host "`n=== Secure Boot ===" -ForegroundColor Cyan
$sb = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\SecureBoot\State" -ErrorAction SilentlyContinue
"Secure Boot: $($sb.UEFISecureBootEnabled) (0=off, 1=on)"

Write-Host "`n=== TPM ===" -ForegroundColor Cyan
$tpm = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Tpm" -ErrorAction SilentlyContinue
"TPM Present: $($tpm.TpmPresent) | Ready: $($tpm.TpmReady)"

Write-Host "`n=== Credential Guard ===" -ForegroundColor Cyan
$lsa = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -ErrorAction SilentlyContinue
"LsaCfgFlags: $($lsa.LsaCfgFlags) (0=off, 1=UEFI lock, 2=no lock)"
"RunAsPPL: $($lsa.RunAsPPL) (0=off, 1=on)"

Write-Host "`n=== HVCI ===" -ForegroundColor Cyan
$hvci = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" -ErrorAction SilentlyContinue
"HVCI Enabled: $($hvci.Enabled) | Locked: $($hvci.Locked)"

Write-Host "`n=== BitLocker ===" -ForegroundColor Cyan
Get-BitLockerVolume -ErrorAction SilentlyContinue |
    Select-Object MountPoint, VolumeStatus, ProtectionStatus | Format-Table

Write-Host "`n=== Defender ===" -ForegroundColor Cyan
$def = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection" -ErrorAction SilentlyContinue
"Real-Time Protection: $(if($def.DisableRealtimeMonitoring -eq 1){'DISABLED'}else{'ENABLED'})"
$feat = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows Defender\Features" -ErrorAction SilentlyContinue
"Tamper Protection: $($feat.TamperProtection) (5=on)"

Write-Host "`n=== WDAC ===" -ForegroundColor Cyan
$ci = Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\CI" -ErrorAction SilentlyContinue
"UMCI Audit Mode: $($ci.UMCIAuditMode) (0=enforce, 1=audit)"

Write-Host "`n=== Audit ===" -ForegroundColor Cyan
auditpol /get /subcategory:"Registry" 2>$null