Get-ExploitProtectionEvents.ps1

<#
.SYNOPSIS
    Queries and analyzes Exploit Protection (Security-Mitigations) event logs.

.DESCRIPTION
    Retrieves events from Microsoft-Windows-Security-Mitigations/KernelMode and
    Microsoft-Windows-Security-Mitigations/UserMode logs. Filters audit and block
    events by process name, event ID, time window, or action type (Audit vs Block).

    Standard Exploit Protection Event IDs:
    - 1 / 2   : Dynamic Code (ACG) [Audit / Block]
    - 3 / 4   : Child Process Restrictions [Audit / Block]
    - 5 / 6   : Low Integrity Image Loads [Audit / Block]
    - 7 / 8   : Remote (UNC) Image Loads [Audit / Block]
    - 9 / 10  : Win32k System Calls [Audit / Block]
    - 11 / 12 : Code Integrity / Module Dependency Signing [Audit / Block]
    - 23 / 24 : Hardware-enforced Stack Protection (CET) [Audit / Block]
    - 33 / 34 : Non-System Font Restrictions [Audit / Block]

.PARAMETER ProcessName
    Filter by executable name or pattern (e.g. 'chrome.exe', 'vlc*').

.PARAMETER Hours
    Retrieve events from the last N hours. Default is 24. Ignored if -All is specified.

.PARAMETER All
    Retrieve all historical events without time limit.

.PARAMETER Action
    Filter events by action type: 'All', 'Audit', or 'Block'. Default is 'All'.

.PARAMETER EventId
    Filter by specific event IDs.

.EXAMPLE
    .\Get-ExploitProtectionEvents.ps1 -Hours 48
    Displays all exploit protection events in the last 48 hours.

.EXAMPLE
    .\Get-ExploitProtectionEvents.ps1 -Action Block
    Displays only blocked mitigation events.

.EXAMPLE
    .\Get-ExploitProtectionEvents.ps1 -ProcessName 'vlc*' -Action Audit
    Displays audit events for processes matching 'vlc*'.
#>

[CmdletBinding()]
param (
    [Parameter(Position = 0)]
    [string]$ProcessName,

    [Parameter()]
    [int]$Hours = 24,

    [Parameter()]
    [switch]$All,

    [Parameter()]
    [ValidateSet('All', 'Audit', 'Block')]
    [string]$Action = 'All',

    [Parameter()]
    [int[]]$EventId
)

Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

$logs = @(
    'Microsoft-Windows-Security-Mitigations/KernelMode',
    'Microsoft-Windows-Security-Mitigations/UserMode'
)

$mitigationMap = @{
    1  = @{ Name = 'Dynamic Code'; Action = 'Audit' }
    2  = @{ Name = 'Dynamic Code'; Action = 'Block' }
    3  = @{ Name = 'Child Process'; Action = 'Audit' }
    4  = @{ Name = 'Child Process'; Action = 'Block' }
    5  = @{ Name = 'Low Integrity Image'; Action = 'Audit' }
    6  = @{ Name = 'Low Integrity Image'; Action = 'Block' }
    7  = @{ Name = 'Remote Image'; Action = 'Audit' }
    8  = @{ Name = 'Remote Image'; Action = 'Block' }
    9  = @{ Name = 'Win32k System Calls'; Action = 'Audit' }
    10 = @{ Name = 'Win32k System Calls'; Action = 'Block' }
    11 = @{ Name = 'Code Integrity / Signing'; Action = 'Audit' }
    12 = @{ Name = 'Code Integrity / Signing'; Action = 'Block' }
    23 = @{ Name = 'User Shadow Stack (CET)'; Action = 'Audit' }
    24 = @{ Name = 'User Shadow Stack (CET)'; Action = 'Block' }
    33 = @{ Name = 'Non-System Fonts'; Action = 'Audit' }
    34 = @{ Name = 'Non-System Fonts'; Action = 'Block' }
}

$startTime = if ($All) { [DateTime]::MinValue } else { (Get-Date).AddHours(-$Hours) }

$results = [System.Collections.Generic.List[PSCustomObject]]::new()

foreach ($log in $logs) {
    try {
        $filter = @{
            LogName   = $log
            StartTime = $startTime
        }
        if ($EventId -and $EventId.Count -gt 0) {
            $filter['Id'] = $EventId
        }

        $events = Get-WinEvent -FilterHashtable $filter -ErrorAction SilentlyContinue
        if (-not $events) { continue }

        foreach ($evt in $events) {
            $id = $evt.Id
            $known = $mitigationMap[$id]
            $mitigationName = if ($known) { $known.Name } else { "Mitigation ($id)" }
            $actionType = if ($known) { $known.Action } else { if ($id % 2 -eq 1) { 'Audit' } else { 'Block' } }

            # Filter by Action if requested
            if ($Action -ne 'All' -and $actionType -ne $Action) {
                continue
            }

            # Parse process info from message or XML
            $msg = $evt.Message
            $proc = 'Unknown'
            $pidVal = $null

            if ($msg -match "Process '(?<path>[^']+)'(?: \(PID (?<pid>\d+)\))?") {
                $rawPath = $Matches['path']
                $proc = Split-Path -Leaf $rawPath
                $pidVal = $Matches['pid']
            }
            elseif ($msg -match "Process (?<proc>[^\s]+) \(PID (?<pid>\d+)\)") {
                $proc = Split-Path -Leaf $Matches['proc']
                $pidVal = $Matches['pid']
            }

            # Filter by ProcessName if specified
            if ($ProcessName -and ($proc -notlike $ProcessName)) {
                continue
            }

            $results.Add([PSCustomObject]@{
                TimeCreated    = $evt.TimeCreated
                EventId        = $id
                Action         = $actionType
                Mitigation     = $mitigationName
                ProcessName    = $proc
                ProcessId      = $pidVal
                LogSource      = (Split-Path -Leaf $log)
                MessageSummary = ($msg -split "`r?`n")[0]
            })
        }
    }
    catch {
        Write-Verbose "Could not query log $log : $_"
    }
}

if ($results.Count -eq 0) {
    Write-Host "No matching Exploit Protection events found." -ForegroundColor Yellow
    return
}

$results | Sort-Object TimeCreated -Descending