使用Intune自定义属性追踪Microsoft Defender PUA策略变更

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

#-------------------------------------------------------------------------------
# Function: analyze_pua_configuration
# Purpose: Analyze the PUA configuration from the threat policy
# Uses global variable PUACHECK
#-------------------------------------------------------------------------------
analyze_pua_configuration() {
    log "INFO" "Analyzing PUA configuration"
    
    if echo "$PUACHECK" | grep -q "Threat type: potentially_unwanted_application"; then
        # PUA policy exists, determine the action setting
        if echo "$PUACHECK" | grep -q "Action: audit"; then
            log "INFO" "PUA status: Audit (PUAs are detected but not blocked)"
            
            # Store for historical tracking
            echo "$(date +"%Y-%m-%d %H:%M:%S") - PUA_ACTION=audit" >> "$POLICY_FILE"
            echo "audit" > "$CURRENT_POLICY_FILE"
            
            if [ "$DEBUG" -eq 1 ]; then
                echo "=== Enhanced MDATP Policy & Health Checker Completed Successfully ==="
            fi
            
            echo "PASSED: PUA in Audit Mode"
            return 0
        elif echo "$PUACHECK" | grep -q "Action: block"; then
            log "INFO" "PUA status: Block (PUAs are actively blocked)"
            
            # Store for historical tracking
            echo "$(date +"%Y-%m-%d %H:%M:%S") - PUA_ACTION=block" >> "$POLICY_FILE"
            echo "block" > "$CURRENT_POLICY_FILE"
            
            if [ "$DEBUG" -eq 1 ]; then
                echo "=== Enhanced MDATP Policy & Health Checker Completed Successfully ==="
            fi
            
            echo "PASSED: PUA in Block Mode"
            return 0
        else
            log "WARNING" "PUA status: Unknown (policy exists but action is undefined)"
            
            # Store for historical tracking
            echo "$(date +"%Y-%m-%d %H:%M:%S") - PUA_ACTION=unknown" >> "$POLICY_FILE"
            echo "unknown" > "$CURRENT_POLICY_FILE"
            
            if [ "$DEBUG" -eq 1 ]; then
                echo "=== Enhanced MDATP Policy & Health Checker Completed with Warnings ==="
            fi
            
            echo "FAILED: PUA status Unknown"
            return 1
        fi
    else
        log "WARNING" "No PUA configuration found"
        
        # Store for historical tracking
        echo "$(date +"%Y-%m-%d %H:%M:%S") - [WARNING] No PUA configuration found" >> "$POLICY_FILE"
        echo "NOT_CONFIGURED" > "$CURRENT_POLICY_FILE"
        
        if [ "$DEBUG" -eq 1 ]; then
            echo "=== Enhanced MDATP Policy & Health Checker Completed with Warnings ==="
        fi
        
        echo "FAILED: PUA Not Configured"
        return 1
    fi
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# Format output for Intune Custom Attribute
debug "Formatting output for Intune Custom Attribute"
if [ "$PREVIOUS_STATE" = "INITIAL_CHECK" ]; then
    debug "Initial check - reporting current state only"
    echo "PUA_Policy=$CURRENT_STATE"
elif [ "$CURRENT_STATE" != "$PREVIOUS_STATE" ]; then
    debug "State change detected - reporting change"
    echo "PUA_Policy=Changed from $PREVIOUS_STATE to $CURRENT_STATE on $(date '+%Y-%m-%d')"
else
    debug "No change in state - reporting with last change date"
    echo "PUA_Policy=$CURRENT_STATE (unchanged since $(date -r "$PREVIOUS_STATE_FILE" '+%Y-%m-%d'))"
fi

if [ "$DEBUG" -eq 1 ]; then
    echo "=== MDATP Custom Attribute Script Completed ===" >&2
fi

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# First check if the current policy file exists and has content
    if [ -f "$CURRENT_POLICY_FILE" ] && [ -s "$CURRENT_POLICY_FILE" ]; then
        local current_state=$(cat "$CURRENT_POLICY_FILE")
        debug "Found current policy file with state: $current_state"
        echo "$current_state"
        return
    fi
    
    debug "Current policy file not found, checking policy log file"
    
    # Fallback to parsing the log file if current policy file is unavailable
    if [ ! -f "$POLICY_FILE" ]; then
        debug "Policy log file not found, returning NOT_CONFIGURED"
        echo "NOT_CONFIGURED"
        return
    fi

1

sudo DEBUG=1 bash ./enhanced_mdatp_pua.sh

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

=== Enhanced MDATP Policy & Health Checker Started (Debug Mode) ===
[INFO] Enhanced MDATP Policy & Health Checker started
[INFO] Checking if Microsoft Defender for Endpoint processes are running
[INFO] Process [wdavdaemon_enterprise] is running
[INFO] Process [wdavdaemon_unprivileged] is running
[INFO] Process [wdavdaemon] is running
[INFO] Microsoft Defender is running properly (all processes verified)
[INFO] Current user: root
[INFO] PATH environment: /usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin
[INFO] Searching for mdatp location...
[INFO] mdatp location from which: /usr/local/bin/mdatp
[INFO] Found mdatp at: /usr/local/bin/mdatp
[INFO] Checking for Microsoft Defender command-line tool (mdatp)
[INFO] Microsoft Defender command-line tool (mdatp) is available at /usr/local/bin/mdatp
[INFO] Retrieving threat policy information
[INFO] Successfully retrieved threat policy information
[INFO] Analyzing PUA configuration
[INFO] PUA status: Audit (PUAs are detected but not blocked)
=== Enhanced MDATP Policy & Health Checker Completed Successfully ===
PASSED: PUA in Audit Mode

1

PUA_Policy=No information available yet – MDATP checker has not run

1

PUA_Policy=DEFENDER_ERROR