Skip to content

Commit 6cfecde

Browse files
eashawmikermcneil
eashaw
and
mikermcneil
authored
Website: Add Powershell commands to queries.yml and standard query library. (#25972)
Changes: - Added powershell commands to windows queries in queries.yml and windows policies in the standard query library. - Updated code blocks on the vital details, policy details, and query details pages to have a tab switcher to switch to view PowerShell commands. --------- Co-authored-by: Mike McNeil <[email protected]>
1 parent 9145709 commit 6cfecde

File tree

14 files changed

+1977
-120
lines changed

14 files changed

+1977
-120
lines changed

‎docs/01-Using-Fleet/standard-query-library/standard-query-library.yml

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,6 +158,17 @@ spec:
158158
'Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies\Password Policy\Minimum password length'
159159
query: |
160160
SELECT 1 FROM security_profile_info WHERE minimum_password_length >= 14;
161+
powershell: |
162+
$netAccountsOutput = net accounts
163+
164+
$minPwdLine = $netAccountsOutput | Where-Object {$_ -match "Minimum password length"}
165+
166+
if ($minPwdLine -match "Minimum password length:\s*(\d+)") {
167+
$minPasswordLength = [int]$matches[1]
168+
if ($minPasswordLength -ge 14) {
169+
Write-Output "1"
170+
}
171+
}
161172
purpose: Informational
162173
tags: compliance, CIS, CIS_Level1, premium
163174
contributors: marcosd4h
@@ -698,6 +709,11 @@ spec:
698709
considered unprotected. Use the additional results (percent_encrypted, conversion_status, etc.) to
699710
help narrow down the specific reason why Windows considers the volume unprotected."
700711
platform: windows
712+
powershell: |
713+
$bitlockerInfo = Get-BitLockerVolume -MountPoint "C:"
714+
if ($bitlockerInfo.ProtectionStatus -eq 1) {
715+
Write-Output 1
716+
}
701717
tags: compliance, hardening, built-in, critical
702718
contributors: defensivedepth
703719
---
@@ -915,6 +931,19 @@ spec:
915931
description: Checks the status of antivirus and signature updates from the Windows Security Center.
916932
resolution: "Ensure Windows Defender or your third-party antivirus is running, up to date, and visible in the Windows Security Center."
917933
tags: compliance, malware, hardening, built-in
934+
powershell: |
935+
$avProducts = Get-CimInstance -Namespace "root/SecurityCenter2" -ClassName
936+
AntiVirusProduct -ErrorAction SilentlyContinue
937+
938+
if ($avProducts) {
939+
$goodProducts = $avProducts | Where-Object {
940+
# Check that the antivirus appears enabled (bit 0x10) and definitions are up‐to‐date (bit 0x100)
941+
($_.productState -band 0x10) -eq 0x10 -and ($_.productState -band 0x100) -eq 0x100
942+
}
943+
if ($goodProducts) {
944+
Write-Output "1"
945+
}
946+
}
918947
platform: windows
919948
contributors: GuillaumeRoss
920949
---
@@ -969,6 +998,86 @@ spec:
969998
query: SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM startup_items WHERE path = "regsvr32" AND args LIKE "%http%");
970999
description: "Checks for an autostart that is attempting to load a dynamic link library (DLL) from the internet."
9711000
resolution: "Remove the suspicious startup entry."
1001+
powershell: |
1002+
$found = $false
1003+
1004+
$startupItems = @()
1005+
1006+
1007+
function Get-RegistryStartupItems {
1008+
$regPaths = @(
1009+
"HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
1010+
"HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run",
1011+
"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run"
1012+
)
1013+
foreach ($regPath in $regPaths) {
1014+
if (Test-Path $regPath) {
1015+
try {
1016+
$props = Get-ItemProperty -Path $regPath -ErrorAction SilentlyContinue
1017+
foreach ($prop in $props.PSObject.Properties) {
1018+
if ($prop.Name -notmatch "^PS(Remote)?$" -and $prop.Value -and ($prop.Name -ne "PSPath" -and $prop.Name -ne "PSParentPath" -and $prop.Name -ne "PSChildName" -and $prop.Name -ne "PSDrive" -and $prop.Name -ne "PSProvider")) {
1019+
$startupItems += $prop.Value
1020+
}
1021+
}
1022+
} catch {
1023+
continue
1024+
}
1025+
}
1026+
}
1027+
}
1028+
1029+
1030+
function Get-StartupFolderItems {
1031+
$folders = @(
1032+
"$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup",
1033+
"$env:ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
1034+
)
1035+
$wscript = New-Object -ComObject WScript.Shell
1036+
foreach ($folder in $folders) {
1037+
if (Test-Path $folder) {
1038+
Get-ChildItem -Path $folder -Filter *.lnk -ErrorAction SilentlyContinue | ForEach-Object {
1039+
try {
1040+
$shortcut = $wscript.CreateShortcut($_.FullName)
1041+
$command = $shortcut.TargetPath
1042+
if ($shortcut.Arguments) {
1043+
$command += " " + $shortcut.Arguments
1044+
}
1045+
$startupItems += $command
1046+
} catch {
1047+
continue
1048+
}
1049+
}
1050+
}
1051+
}
1052+
}
1053+
1054+
1055+
Get-RegistryStartupItems
1056+
1057+
Get-StartupFolderItems
1058+
1059+
1060+
foreach ($item in $startupItems) {
1061+
if (-not $item) { continue }
1062+
# Remove any surrounding quotes and trim whitespace.
1063+
$item = $item.Trim('"').Trim()
1064+
if ($item.Length -eq 0) { continue }
1065+
# Split into tokens by whitespace.
1066+
$tokens = $item -split "\s+"
1067+
if ($tokens.Count -eq 0) { continue }
1068+
# Get the executable portion and extract the file name without extension.
1069+
$exePath = $tokens[0]
1070+
$exeName = [System.IO.Path]::GetFileNameWithoutExtension($exePath)
1071+
if ($exeName -ieq "regsvr32" -and $item -imatch "http") {
1072+
$found = $true
1073+
break
1074+
}
1075+
}
1076+
1077+
1078+
if (-not $found) {
1079+
Write-Output "1"
1080+
}
9721081
tags: malware, hunting
9731082
platform: windows
9741083
contributors: kswagler-rh
@@ -1072,6 +1181,14 @@ spec:
10721181
query: SELECT 1 FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\InactivityTimeoutSecs' AND CAST(data as INTEGER) <= 1800;
10731182
description: "Checks if the screen lock is enabled and configured to lock the system within 30 minutes or less."
10741183
resolution: "Contact your IT administrator to enable the Interactive Logon: Machine inactivity limit setting with a value of 1800 seconds or lower."
1184+
powershell: |
1185+
$regPath = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System'
1186+
$value = (Get-ItemProperty -Path $regPath -Name 'InactivityTimeoutSecs' -ErrorAction SilentlyContinue).InactivityTimeoutSecs
1187+
if ($value -and ([int]$value) -le 1800) {
1188+
Write-Output 1
1189+
} else {
1190+
Write-Output 0
1191+
}
10751192
tags: compliance, hardening, built-in
10761193
platform: windows
10771194
contributors: GuillaumeRoss
@@ -1784,6 +1901,14 @@ kind: policy
17841901
spec:
17851902
name: Firewall enabled, domain profile (Windows)
17861903
query: SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\DomainProfile\EnableFirewall' AND CAST(data as integer) = 1;
1904+
powershell: |
1905+
$regPath = 'HKLM:\Software\Policies\Microsoft\WindowsFirewall\DomainProfile'
1906+
$value = (Get-ItemProperty -Path $regPath -Name 'EnableFirewall' -ErrorAction SilentlyContinue).EnableFirewall
1907+
if ($value -eq 1) {
1908+
Write-Output 1
1909+
} else {
1910+
Write-Output 0
1911+
}
17871912
description: "Checks if a Group Policy configures the computer to enable the domain profile for Windows Firewall. The domain profile applies to networks where the host system can authenticate to a domain controller. Some auditors requires that this setting is configured by a Group Policy."
17881913
resolution: "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the domain profile for Windows Firewall."
17891914
platforms: Windows
@@ -1796,6 +1921,14 @@ kind: policy
17961921
spec:
17971922
name: Firewall enabled, private profile (Windows)
17981923
query: SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile\EnableFirewall' AND CAST(data as integer) = 1;
1924+
powershell: |
1925+
$regPath = 'HKLM:\Software\Policies\Microsoft\WindowsFirewall\PrivateProfile'
1926+
$value = (Get-ItemProperty -Path $regPath -Name 'EnableFirewall' -ErrorAction SilentlyContinue).EnableFirewall
1927+
if ($value -eq 1) {
1928+
Write-Output 1
1929+
} else {
1930+
Write-Output 0
1931+
}
17991932
description: "Checks if a Group Policy configures the computer to enable the private profile for Windows Firewall. The private profile applies to networks where the host system is connected to a private or home network. Some auditors requires that this setting is configured by a Group Policy."
18001933
resolution: "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the private profile for Windows Firewall."
18011934
platforms: Windows
@@ -1808,6 +1941,14 @@ kind: policy
18081941
spec:
18091942
name: Firewall enabled, public profile (Windows)
18101943
query: SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\EnableFirewall' AND CAST(data as integer) = 1;
1944+
powershell: |
1945+
$regPath = 'HKLM:\Software\Policies\Microsoft\WindowsFirewall\PublicProfile'
1946+
$value = (Get-ItemProperty -Path $regPath -Name 'EnableFirewall' -ErrorAction SilentlyContinue).EnableFirewall
1947+
if ($value -eq 1) {
1948+
Write-Output 1
1949+
} else {
1950+
Write-Output 0
1951+
}
18111952
description: "Checks if a Group Policy configures the computer to enable the public profile for Windows Firewall. The public profile applies to networks where the host system is connected to public networks such as Wi-Fi hotspots at coffee shops and airports. Some auditors requires that this setting is configured by a Group Policy."
18121953
resolution: "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the public profile for Windows Firewall."
18131954
platforms: Windows
@@ -1820,6 +1961,13 @@ kind: policy
18201961
spec:
18211962
name: SMBv1 client driver disabled (Windows)
18221963
query: SELECT 1 FROM windows_optional_features WHERE name = 'SMB1Protocol-Client' AND state != 1;
1964+
powershell: |
1965+
$feature = Get-WindowsOptionalFeature -FeatureName 'SMB1Protocol-Client' -Online -ErrorAction SilentlyContinue
1966+
if ($feature -and $feature.State -ne 'Enabled') {
1967+
Write-Output 1
1968+
} else {
1969+
Write-Output 0
1970+
}
18231971
description: "Checks that the SMBv1 client is disabled."
18241972
resolution: "Contact your IT administrator to discuss disabling SMBv1 on your system."
18251973
platforms: Windows
@@ -1832,6 +1980,13 @@ kind: policy
18321980
spec:
18331981
name: SMBv1 server disabled (Windows)
18341982
query: SELECT 1 FROM windows_optional_features WHERE name = 'SMB1Protocol-Server' AND state != 1
1983+
powershell: |
1984+
$feature = Get-WindowsOptionalFeature -FeatureName 'SMB1Protocol-Server' -Online -ErrorAction SilentlyContinue
1985+
if ($feature -and $feature.State -ne 'Enabled') {
1986+
Write-Output 1
1987+
} else {
1988+
Write-Output 0
1989+
}
18351990
description: "Checks that the SMBv1 server is disabled."
18361991
resolution: "Contact your IT administrator to discuss disabling SMBv1 on your system."
18371992
platforms: Windows
@@ -1844,6 +1999,14 @@ kind: policy
18441999
spec:
18452000
name: Link-Local Multicast Name Resolution (LLMNR) disabled (Windows)
18462001
query: SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient\EnableMulticast' AND CAST(data as integer) = 0;
2002+
powershell: |
2003+
$regPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\DNSClient'
2004+
$value = (Get-ItemProperty -Path $regPath -Name 'EnableMulticast' -ErrorAction SilentlyContinue).EnableMulticast
2005+
if ($value -eq 0) {
2006+
Write-Output 1
2007+
} else {
2008+
Write-Output 0
2009+
}
18472010
description: "Checks if a Group Policy configures the computer to disable LLMNR. Disabling LLMNR can prevent malicious actors from gaining access to the computer's credentials. Some auditors require that this setting is configured by a Group Policy."
18482011
resolution: "Contact your IT administrator to ensure your computer is receiving a Group Policy that disables LLMNR on your system."
18492012
platforms: Windows
@@ -1856,6 +2019,14 @@ kind: policy
18562019
spec:
18572020
name: Automatic updates enabled (Windows)
18582021
query: SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoUpdate' AND CAST(data as integer) = 0;
2022+
powershell: |
2023+
$regPath = 'HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate\AU'
2024+
$value = (Get-ItemProperty -Path $regPath -Name 'NoAutoUpdate' -ErrorAction SilentlyContinue).NoAutoUpdate
2025+
if ($value -eq 0) {
2026+
Write-Output 1
2027+
} else {
2028+
Write-Output 0
2029+
}
18592030
description: "Checks if a Group Policy configures the computer to enable Automatic Updates. When enabled, the computer downloads and installs security and other important updates automatically. Some auditors require that this setting is configured by a Group Policy."
18602031
resolution: "Contact your IT administrator to ensure your computer is receiving a Group policy that enables Automatic Updates."
18612032
platforms: Windows

0 commit comments

Comments
 (0)