jmconway

<# Hardening Changes for WinVerifyTrust Signature Validation Vuln (CVE-2013-3900)
## 10+ year old "Opt In" Mitigation Still Exploited to This Day
## https://msrc.microsoft.com/update-guide/vulnerability/CVE-2013-3900
## https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3900
## Inspired by: https://www.bleepingcomputer.com/news/microsoft/10-year-old-windows-bug-with-opt-in-fix-exploited-in-3cx-attack/
#>

<# Helper Function
## For the purposes of this script, assume DWORD values
#>

jmconway

# For the purposes of this script, assume DWORD values
function Set-RegistryItem {
    param (
        [CmdletBinding()]
        [string]$Path
    )
    param (
        [CmdletBinding()]
        [string]$Name
    )

jmconway

[{"id":"200074e5620e35537d603e650752542ab291caa0dd7fe454505153b8108c1fb6","cid":"dc674dd858a84b689924ad92032d57be","type":"sha256","value":"4dc13bb83a16d4ff9865a51b3e4d24112327c526c1392e14d56f20d6f4eaf382","action":"prevent","mobile_action":"no_action","severity":"critical","severity_number":"90","description":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ukraine-wiper-malware-russia","metadata":{"filename":"Trojan.Killdisk","signed":false,"av_hits":5},"platforms":["windows"],"expired":false,"applied_globally":true,"deleted":false,"created_on":"2022-02-24T20:25:32.052764249Z","modified_on":"2022-02-24T20:27:31.151955481Z"},{"id":"8a86f9ab6cdf26120b3040f75c2a31ee5ac3680b79ae8e1147daab198bca473c","cid":"dc674dd858a84b689924ad92032d57be","type":"sha256","value":"a64c3e0522fad787b95bfb6a30c3aed1b5786e69e88e023c062ec7e5cebf4d3e","action":"prevent","mobile_action":"no_action","severity":"critical","severity_number":"90","description":"https://symantec-enterprise-blogs.security.com/blogs/

jmconway

jmconway

function Set-OptionalFeatures {
    # Features we want to disable by default
    $toDisable = "Internet-Explorer-Optional-amd64","MicrosoftWindowsPowerShellV2","MicrosoftWindowsPowerShellV2Root","Printing-XPSServices-Features","WCF-Services45","WCF-TCP-PortSharing45","WindowsMediaPlayer","WorkFolders-Client"

    foreach ($feature in $toDisable) {
        Get-WindowsOptionalFeature -Online -FeatureName $feature | Disable-WindowsOptionalFeature -Online -NoRestart -Remove -Verbose
    }
    
    # Features we want to enable by default
    $toEnable = "Containers", "Containers-DisposableClientVM","Windows-Defender-ApplicationGuard", "Microsoft-Windows-Subsystem-Linux"

jmconway

PS C:\Windows\system32> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.19041.1320
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.19041.1320
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0

jmconway

# Function to take a given txt or csv file and compare it against Active Directory
# Requires the Active Directory PowerShell Module
# EXAMPLE: Compare-ADFromFile -File .\affected_user_accounts.txt
function Compare-ADFromFile {
    # Path to the file of names to compare against AD
    [CmdletBinding()]
    param (
        [Parameter(Position=0, Mandatory, ValueFromPipeline)]
        [System.String[]]
        $File

jmconway

$URL = ""
$targetprocess = "iexplore"
$process = Get-Process -Name $targetprocess -ErrorAction SilentlyContinue

# Infinite loop
while ($true){
    # Initial launch of the application
    # While the process is not running
    while (!($process)){
        $process = Get-Process -Name $targetprocess -ErrorAction SilentlyContinue

jmconway

# Disable Cortana

$regPath = "HKLM:\\SOFTWARE\Policies\Microsoft\Windows\Windows Search"
$regName = "AllowCortana"
$regValue = "0"

# If $regPath doesn't exist (which it likely doesn't by default), create it

if (!(Test-Path -Path $regPath)) {
    New-Item -Path $regPath

jmconway

$provisioned = "Microsoft.GetHelp_10.1706.13331.0_neutral_~_8wekyb3d8bbwe","Microsoft.Getstarted_8.2.22942.0_neutral_~_8wekyb3d8bbwe","Microsoft.MicrosoftOfficeHub_18.1903.1152.0_neutral_~_8wekyb3d8bbwe","Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_~_8wekyb3d8bbwe","Microsoft.Office.OneNote_16001.12026.20112.0_neutral_~_8wekyb3d8bbwe","Microsoft.People_2019.305.632.0_neutral_~_8wekyb3d8bbwe","Microsoft.Wallet_2.4.18324.0_neutral_~_8wekyb3d8bbwe","microsoft.windowscommunicationsapps_16005.11629.20316.0_neutral_~_8wekyb3d8bbwe","Microsoft.WindowsFeedbackHub_2019.1111.2029.0_neutral_~_8wekyb3d8bbwe","Microsoft.YourPhone_2019.430.2026.0_neutral_~_8wekyb3d8bbwe","Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe","Microsoft.ZuneVideo_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe"

$appx = "Microsoft.Windows.PeopleExperienceHost","Microsoft.GetHelp","Microsoft.Getstarted","Microsoft.MicrosoftOfficeHub","Microsoft.MicrosoftSolitaireCollection","Microsoft.Office.OneNote","Microsoft.Wallet","mi