ConvertTo-WDACPolicy available parameters¶
Syntax¶
ConvertTo-WDACPolicy
[-PolicyToAddLogsTo <FileInfo>]
[-Source <String>]
[-SuppPolicyName <String>]
[-Level <String>]
[-MDEAHLogs <FileInfo[]>]
[-EVTXLogs <FileInfo[]>]
[-FilterByPolicyNames <String[]>]
[-TimeSpan <String>]
[-TimeSpanAgo <UInt64>]
[-KernelModeOnly]
[-LogType <String>]
[-Deploy]
[-ExtremeVisibility]
[<CommonParameters>]
ConvertTo-WDACPolicy
[-BasePolicyFile <FileInfo>]
[-Source <String>]
[-SuppPolicyName <String>]
[-Level <String>]
[-MDEAHLogs <FileInfo[]>]
[-EVTXLogs <FileInfo[]>]
[-FilterByPolicyNames <String[]>]
[-TimeSpan <String>]
[-TimeSpanAgo <UInt64>]
[-KernelModeOnly]
[-LogType <String>]
[-Deploy]
[-ExtremeVisibility]
[<CommonParameters>]
ConvertTo-WDACPolicy
[-BasePolicyGUID <Guid>]
[-Source <String>]
[-SuppPolicyName <String>]
[-Level <String>]
[-MDEAHLogs <FileInfo[]>]
[-EVTXLogs <FileInfo[]>]
[-FilterByPolicyNames <String[]>]
[-TimeSpan <String>]
[-TimeSpanAgo <UInt64>]
[-KernelModeOnly]
[-LogType <String>]
[-Deploy]
[-ExtremeVisibility]
[<CommonParameters>]
Description¶
This is a multi-purpose cmdlet that offers a wide range of functionalities that can either be used separately or mixed together for very detailed and specific tasks.
It currently supports Code Integrity and AppLocker logs from the following sources:
- Local Event logs
- Evtx log files
- Microsoft Defender for Endpoint Advanced Hunting results
The cmdlet displays the logs in a GUI and allows the user to select the logs to be processed further.
The logs can be filtered based on many criteria using the available parameters.
The output of this cmdlet is a Supplemental Application Control (WDAC) policy. Based on the input parameters, it can be associated with a base policy or merged with an existing Base or Supplemental policy.
The cmdlet can be used for local and remote systems. You can utilize this cmdlet to create App Control for Business policies from MDE Advanced Hunting and then deploy them using Microsoft Intune to your endpoints.
You can utilize this cmdlet to use the evtx log files you aggregated from your endpoints and create an App Control policy from them.
This offers scalability and flexibility in managing your security policies.
Parameters¶
-PolicyToAddLogsTo¶
The policy to add the selected logs to, it can either be a base or supplemental policy.
Important
Only select one of the following three parameters: -PolicyToAddLogsTo, -BasePolicyFile, or -BasePolicyGUID.
| Type: | FileInfo |
|---|---|
| Aliases: | AddLogs |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-BasePolicyFile¶
The base policy file to associate the supplemental policy with.
Important
Only select one of the following three parameters: -PolicyToAddLogsTo, -BasePolicyFile, or -BasePolicyGUID.
| Type: | FileInfo |
|---|---|
| Aliases: | BaseFile |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-BasePolicyGUID¶
The GUID of the base policy to associate the supplemental policy with.
Important
Only select one of the following three parameters: -PolicyToAddLogsTo, -BasePolicyFile, or -BasePolicyGUID.
| Type: | Guid |
|---|---|
| Aliases: | BaseGUID |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Source¶
The source of the logs. Supports validate set and auto-completion, press TAB key to view the list of the available options.
| Type: | String |
|---|---|
| Aliases: | Src |
| Position: | Named |
| Accepted values: | LocalEventLogs, MDEAdvancedHunting, EVTXFiles |
| Default value: | LocalEventLogs |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-SuppPolicyName¶
The name of the supplemental policy to create
| Type: | String |
|---|---|
| Aliases: | Name |
| Position: | Named |
| Default value: | The cmdlet will generate a proper name based on the selected source and time |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Level¶
The level determining rule generation can be one of the following: Auto, FilePublisher, Publisher, or Hash.
The fallback level is always Hash.
By default, which is the same as not using this parameter, the most secure levels are prioritized. If a log contains the requisite details for the FilePublisher level, it will be utilized. If not, the Publisher level will be attempted. Should this also fail, the Hash level will be employed.
| Type: | String |
|---|---|
| Aliases: | Lvl |
| Position: | Named |
| Default value: | Auto |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-MDEAHLogs¶
The path(s) to use MDE AH CSV files.
Note
This is a dynamic parameter and will only be available if the Source parameter is set to MDEAdvancedHunting.
Important
Please read this article for complete information on how to use this feature.
| Type: | FileInfo[] |
|---|---|
| Aliases: | MDELogs |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-EVTXLogs¶
The path(s) of EVTX files to use.
Note
This is a dynamic parameter and will only be available if the Source parameter is set to EVTXFiles.
| Type: | FileInfo[] |
|---|---|
| Aliases: | Evtx |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-TimeSpan¶
The unit of time to use when filtering the logs by the time.
| Type: | String |
|---|---|
| Aliases: | Duration |
| Position: | Named |
| Accepted values: | Minutes, Hours, Days |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-TimeSpanAgo¶
The number of the selected time unit to go back in time from the current time.
Note
This is a dynamic parameter and will only be available if the TimeSpan parameter is set.
| Type: | String |
|---|---|
| Aliases: | Past |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-FilterByPolicyNames¶
The names of the policies to filter the logs by. Supports auto-completion, press TAB key to view the list of the deployed base policy names to choose from. It will not display the policies that are already selected on the command line.
You can manually enter the name of the policies that are no longer available on the system.
| Type: | String[] |
|---|---|
| Aliases: | FilterNames |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-KernelModeOnly¶
If used, will filter the logs by including only the Kernel-Mode logs.
| Type: | SwitchParameter |
|---|---|
| Aliases: | KMode |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-LogType¶
The type of logs to display.
| Type: | String |
|---|---|
| Aliases: | LogKind |
| Position: | Named |
| Accepted values: | Audit, Blocked |
| Default value: | Audit |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-Deploy¶
If used, will deploy the policy on the system.
| Type: | SwitchParameter |
|---|---|
| Aliases: | Up |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |
-ExtremeVisibility¶
If used, will display all the properties of the logs without any filtering.
| Type: | SwitchParameter |
|---|---|
| Aliases: | XVis |
| Position: | Named |
| Default value: | None |
| Required: | False |
| Accept pipeline input: | False |
| Accept wildcard characters: | False |