#!/usr/bin/env python3
"""Windows Defender advanced configuration audit agent."""

import json
import argparse
import subprocess
from datetime import datetime


def get_defender_status():
    """Get Windows Defender status via PowerShell."""
    cmd = ["powershell", "-Command", "Get-MpComputerStatus | ConvertTo-Json"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        return json.loads(result.stdout) if result.stdout.strip() else {"error": "No output"}
    except (FileNotFoundError, json.JSONDecodeError, subprocess.TimeoutExpired) as e:
        return {"error": str(e)}


def get_defender_preferences():
    """Get Windows Defender preference settings."""
    cmd = ["powershell", "-Command", "Get-MpPreference | ConvertTo-Json"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        return json.loads(result.stdout) if result.stdout.strip() else {"error": "No output"}
    except (FileNotFoundError, json.JSONDecodeError, subprocess.TimeoutExpired) as e:
        return {"error": str(e)}


def audit_asr_rules():
    """Audit Attack Surface Reduction rules configuration."""
    cmd = ["powershell", "-Command",
           "Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids | ConvertTo-Json"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        rule_ids = json.loads(result.stdout) if result.stdout.strip() else []
    except (FileNotFoundError, json.JSONDecodeError):
        rule_ids = []
    critical_asr_rules = {
        "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550": "Block executable content from email and webmail",
        "d4f940ab-401b-4efc-aadc-ad5f3c50688a": "Block all Office applications from creating child processes",
        "3b576869-a4ec-4529-8536-b80a7769e899": "Block Office applications from creating executable content",
        "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84": "Block Office applications from injecting code",
        "d3e037e1-3eb8-44c8-a917-57927947596d": "Block JavaScript or VBScript from launching downloaded content",
        "5beb7efe-fd9a-4556-801d-275e5ffc04cc": "Block execution of potentially obfuscated scripts",
        "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b": "Block Win32 API calls from Office macros",
        "56a863a9-875e-4185-98a7-b882c64b5ce5": "Block abuse of exploited vulnerable signed drivers",
    }
    configured = set(rule_ids) if isinstance(rule_ids, list) else set()
    missing = []
    for rule_id, desc in critical_asr_rules.items():
        if rule_id not in configured:
            missing.append({"rule_id": rule_id, "description": desc, "severity": "HIGH"})
    return {"configured_count": len(configured), "missing_critical": missing}


def check_tamper_protection():
    """Check tamper protection status."""
    cmd = ["powershell", "-Command",
           "(Get-MpComputerStatus).IsTamperProtected"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=15)
        enabled = "true" in result.stdout.strip().lower()
        return {"tamper_protection": enabled,
                "severity": "CRITICAL" if not enabled else "INFO"}
    except (FileNotFoundError, subprocess.TimeoutExpired):
        return {"error": "Cannot check tamper protection"}


def run_audit():
    """Execute Windows Defender audit."""
    print(f"\n{'='*60}")
    print(f"  WINDOWS DEFENDER ADVANCED SETTINGS AUDIT")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    status = get_defender_status()
    print(f"--- DEFENDER STATUS ---")
    if "error" not in status:
        print(f"  Real-time protection: {status.get('RealTimeProtectionEnabled', 'N/A')}")
        print(f"  Behavior monitoring: {status.get('BehaviorMonitorEnabled', 'N/A')}")
        print(f"  Cloud protection: {status.get('OnAccessProtectionEnabled', 'N/A')}")
        print(f"  Signature version: {status.get('AntivirusSignatureVersion', 'N/A')}")

    asr = audit_asr_rules()
    print(f"\n--- ASR RULES ---")
    print(f"  Configured: {asr['configured_count']}")
    print(f"  Missing critical: {len(asr['missing_critical'])}")
    for rule in asr["missing_critical"][:5]:
        print(f"    [{rule['severity']}] {rule['description']}")

    tamper = check_tamper_protection()
    print(f"\n--- TAMPER PROTECTION ---")
    print(f"  Enabled: {tamper.get('tamper_protection', 'N/A')}")

    return {"status": status, "asr": asr, "tamper": tamper}


def main():
    parser = argparse.ArgumentParser(description="Windows Defender Audit Agent")
    parser.add_argument("--audit", action="store_true", help="Run full audit")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    if args.audit:
        report = run_audit()
        if args.output:
            with open(args.output, "w") as f:
                json.dump(report, f, indent=2, default=str)
            print(f"\n[+] Report saved to {args.output}")
    else:
        parser.print_help()


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Windows Defender Configuration Auditor

Collects and audits Microsoft Defender for Endpoint settings across endpoints,
identifies configuration gaps, and generates compliance reports.
"""

import json
import subprocess
import sys
import os
from datetime import datetime


RECOMMENDED_SETTINGS = {
    "RealTimeProtectionEnabled": True,
    "BehaviorMonitoringEnabled": True,
    "IoavProtectionEnabled": True,
    "AntispywareEnabled": True,
    "AntivirusEnabled": True,
    "MAPSReporting": 2,  # Advanced
    "SubmitSamplesConsent": 3,  # SendAllSamples
    "PUAProtection": 1,  # Enabled
    "DisableBlockAtFirstSeen": False,
    "CloudBlockLevel": 2,  # High
    "CloudExtendedTimeout": 50,
    "EnableNetworkProtection": 1,  # Enabled
    "EnableControlledFolderAccess": 1,  # Enabled
    "SignatureUpdateInterval": 1,  # Hourly
}

RECOMMENDED_ASR_RULES = {
    "BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550": {"name": "Block executable content from email", "mode": 1},
    "D4F940AB-401B-4EFC-AADC-AD5F3C50688A": {"name": "Block Office child processes", "mode": 1},
    "3B576869-A4EC-4529-8536-B80A7769E899": {"name": "Block Office executable creation", "mode": 1},
    "75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84": {"name": "Block Office code injection", "mode": 1},
    "D3E037E1-3EB8-44C8-A917-57927947596D": {"name": "Block JS/VBS launching executables", "mode": 1},
    "5BEB7EFE-FD9A-4556-801D-275E5FFC04CC": {"name": "Block obfuscated scripts", "mode": 1},
    "92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B": {"name": "Block Win32 API from macros", "mode": 1},
    "9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2": {"name": "Block LSASS credential stealing", "mode": 1},
    "D1E49AAC-8F56-4280-B9BA-993A6D77406C": {"name": "Block PSExec/WMI processes", "mode": 1},
    "B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4": {"name": "Block untrusted USB processes", "mode": 1},
    "E6DB77E5-3DF2-4CF1-B95A-636979351E5B": {"name": "Block WMI persistence", "mode": 1},
    "56A863A9-875E-4185-98A7-B882C64B5CE5": {"name": "Block vulnerable signed drivers", "mode": 1},
}


def collect_defender_settings() -> dict:
    """Collect current Defender settings via PowerShell."""
    ps_cmd = """
    $prefs = Get-MpPreference
    $status = Get-MpComputerStatus
    $result = @{
        Preferences = @{
            RealTimeProtectionEnabled = $prefs.DisableRealtimeMonitoring -eq $false
            BehaviorMonitoringEnabled = $prefs.DisableBehaviorMonitoring -eq $false
            IoavProtectionEnabled = $prefs.DisableIOAVProtection -eq $false
            AntispywareEnabled = $status.AntispywareEnabled
            AntivirusEnabled = $status.AntivirusEnabled
            MAPSReporting = $prefs.MAPSReporting
            SubmitSamplesConsent = $prefs.SubmitSamplesConsent
            PUAProtection = $prefs.PUAProtection
            DisableBlockAtFirstSeen = $prefs.DisableBlockAtFirstSeen
            CloudBlockLevel = $prefs.CloudBlockLevel
            CloudExtendedTimeout = $prefs.CloudExtendedTimeout
            EnableNetworkProtection = $prefs.EnableNetworkProtection
            EnableControlledFolderAccess = $prefs.EnableControlledFolderAccess
            SignatureUpdateInterval = $prefs.SignatureUpdateInterval
        }
        ASRRules = @{}
        Status = @{
            AMEngineVersion = $status.AMEngineVersion
            AMProductVersion = $status.AMProductVersion
            AntispywareSignatureVersion = $status.AntispywareSignatureVersion
            AntivirusSignatureVersion = $status.AntivirusSignatureVersion
            AntivirusSignatureLastUpdated = $status.AntivirusSignatureLastUpdated.ToString('o')
            FullScanEndTime = if($status.FullScanEndTime) { $status.FullScanEndTime.ToString('o') } else { 'Never' }
            QuickScanEndTime = if($status.QuickScanEndTime) { $status.QuickScanEndTime.ToString('o') } else { 'Never' }
            RealTimeProtectionEnabled = $status.RealTimeProtectionEnabled
            TamperProtectionSource = $status.IsTamperProtected
        }
    }
    $ids = $prefs.AttackSurfaceReductionRules_Ids
    $actions = $prefs.AttackSurfaceReductionRules_Actions
    if ($ids -and $actions) {
        for ($i=0; $i -lt $ids.Count; $i++) {
            $result.ASRRules[$ids[$i].ToString().ToUpper()] = $actions[$i]
        }
    }
    $result | ConvertTo-Json -Depth 3
    """

    try:
        result = subprocess.run(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            capture_output=True, text=True, timeout=30,
        )
        if result.returncode == 0 and result.stdout.strip():
            return json.loads(result.stdout)
        else:
            return {"error": result.stderr or "Failed to collect Defender settings"}
    except FileNotFoundError:
        return {"error": "PowerShell not available (requires Windows)"}
    except subprocess.TimeoutExpired:
        return {"error": "PowerShell command timed out"}
    except json.JSONDecodeError as e:
        return {"error": f"Failed to parse PowerShell output: {e}"}


def audit_settings(settings: dict) -> dict:
    """Audit collected settings against recommended baseline."""
    findings = {
        "compliant": [],
        "non_compliant": [],
        "asr_rules": {
            "enabled_block": [],
            "enabled_audit": [],
            "disabled": [],
            "missing": [],
        },
        "score": 0.0,
    }

    prefs = settings.get("Preferences", {})
    total_checks = 0
    passed_checks = 0

    for setting, expected in RECOMMENDED_SETTINGS.items():
        total_checks += 1
        actual = prefs.get(setting)

        if actual == expected:
            passed_checks += 1
            findings["compliant"].append({
                "setting": setting,
                "expected": expected,
                "actual": actual,
            })
        else:
            findings["non_compliant"].append({
                "setting": setting,
                "expected": expected,
                "actual": actual,
                "severity": "high" if setting in (
                    "RealTimeProtectionEnabled", "AntivirusEnabled",
                    "EnableNetworkProtection", "MAPSReporting",
                ) else "medium",
            })

    asr_rules = settings.get("ASRRules", {})
    for rule_guid, rule_info in RECOMMENDED_ASR_RULES.items():
        total_checks += 1
        mode = asr_rules.get(rule_guid)

        if mode == 1:
            passed_checks += 1
            findings["asr_rules"]["enabled_block"].append({
                "guid": rule_guid, "name": rule_info["name"],
            })
        elif mode == 2:
            findings["asr_rules"]["enabled_audit"].append({
                "guid": rule_guid, "name": rule_info["name"],
            })
        elif mode == 0:
            findings["asr_rules"]["disabled"].append({
                "guid": rule_guid, "name": rule_info["name"],
            })
        else:
            findings["asr_rules"]["missing"].append({
                "guid": rule_guid, "name": rule_info["name"],
            })

    if total_checks > 0:
        findings["score"] = round((passed_checks / total_checks) * 100, 2)

    return findings


def generate_report(settings: dict, findings: dict, output_path: str) -> None:
    """Generate configuration audit report."""
    report = {
        "report_generated": datetime.utcnow().isoformat() + "Z",
        "defender_status": settings.get("Status", {}),
        "compliance_score": findings["score"],
        "total_compliant": len(findings["compliant"]),
        "total_non_compliant": len(findings["non_compliant"]),
        "asr_summary": {
            "block_mode": len(findings["asr_rules"]["enabled_block"]),
            "audit_mode": len(findings["asr_rules"]["enabled_audit"]),
            "disabled": len(findings["asr_rules"]["disabled"]),
            "not_configured": len(findings["asr_rules"]["missing"]),
        },
        "non_compliant_settings": findings["non_compliant"],
        "asr_details": findings["asr_rules"],
    }

    with open(output_path, "w", encoding="utf-8") as f:
        json.dump(report, f, indent=2)


if __name__ == "__main__":
    output_dir = sys.argv[1] if len(sys.argv) > 1 else "."

    print("Collecting Microsoft Defender settings...")
    settings = collect_defender_settings()

    if "error" in settings:
        print(f"Error: {settings['error']}")
        print("This tool requires Windows with Microsoft Defender for Endpoint.")
        sys.exit(1)

    print("Auditing against recommended baseline...")
    findings = audit_settings(settings)

    report_path = os.path.join(output_dir, "defender_audit_report.json")
    generate_report(settings, findings, report_path)
    print(f"Audit report: {report_path}")

    print(f"\n--- Defender Configuration Audit ---")
    print(f"Compliance Score: {findings['score']}%")
    print(f"Compliant settings: {len(findings['compliant'])}")
    print(f"Non-compliant: {len(findings['non_compliant'])}")
    print(f"\nASR Rules:")
    print(f"  Block mode: {len(findings['asr_rules']['enabled_block'])}")
    print(f"  Audit mode: {len(findings['asr_rules']['enabled_audit'])}")
    print(f"  Disabled: {len(findings['asr_rules']['disabled'])}")
    print(f"  Not configured: {len(findings['asr_rules']['missing'])}")

    if findings["non_compliant"]:
        print(f"\nNon-compliant settings requiring remediation:")
        for item in findings["non_compliant"]:
            print(f"  [{item['severity'].upper()}] {item['setting']}: expected={item['expected']}, actual={item['actual']}")