From a9e3b3d5de530790c6dc457190787bd287b4e334 Mon Sep 17 00:00:00 2001
From: Chris Long <clong@cl0ng.com>
Date: Sat, 5 Dec 2020 09:16:42 -0800
Subject: [PATCH] Update Defender GPO, Update Splunk UF

---
 .../GPO/disable_windows_defender/manifest.xml |   1 -
 .../Backup.xml                                |  18 ------------------
 .../DomainSysvol/GPO/Machine/registry.pol     | Bin 368 -> 0 bytes
 .../bkupInfo.xml                              |   1 -
 .../Backup.xml                                |  18 ++++++++++++++++++
 .../Machine/Preferences/Registry/Registry.xml |   3 +++
 .../DomainSysvol/GPO/Machine/comment.cmtx     |   0
 .../DomainSysvol/GPO/Machine/registry.pol     | Bin 0 -> 1560 bytes
 .../bkupInfo.xml                              |   1 +
 .../gpreport.xml                              | Bin 20188 -> 30544 bytes
 .../windows/Microsoft.PowerShell_profile.ps1  |   6 ++----
 ...configure-disable-windows-defender-gpo.ps1 |   2 +-
 .../scripts/install-evtx-attack-samples.ps1   |   2 +-
 Vagrant/scripts/install-splunkuf.ps1          |  12 ++++++------
 14 files changed, 32 insertions(+), 32 deletions(-)
 delete mode 100755 Vagrant/resources/GPO/disable_windows_defender/manifest.xml
 delete mode 100755 Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/Backup.xml
 delete mode 100755 Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/registry.pol
 delete mode 100755 Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/bkupInfo.xml
 create mode 100644 Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml
 create mode 100644 Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
 rename Vagrant/resources/GPO/disable_windows_defender/{{A1B5F23F-DC23-4225-98D0-22FD4EAF312C} => {F2150233-4B8F-4347-8D70-23D3984D9B78}}/DomainSysvol/GPO/Machine/comment.cmtx (100%)
 mode change 100755 => 100644
 create mode 100644 Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/registry.pol
 create mode 100644 Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml
 rename Vagrant/resources/GPO/disable_windows_defender/{{A1B5F23F-DC23-4225-98D0-22FD4EAF312C} => {F2150233-4B8F-4347-8D70-23D3984D9B78}}/gpreport.xml (53%)
 mode change 100755 => 100644

diff --git a/Vagrant/resources/GPO/disable_windows_defender/manifest.xml b/Vagrant/resources/GPO/disable_windows_defender/manifest.xml
deleted file mode 100755
index 2382df2a9..000000000
--- a/Vagrant/resources/GPO/disable_windows_defender/manifest.xml
+++ /dev/null
@@ -1 +0,0 @@
-<Backups xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest" xmlns:mfst="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest" mfst:version="1.0"><BackupInst><GPOGuid><![CDATA[{288D6F79-F949-4C97-BE07-8997DBE821BC}]]></GPOGuid><GPODomain><![CDATA[windomain.local]]></GPODomain><GPODomainGuid><![CDATA[{d2ef48b7-bc16-4377-a67f-dbaab78aa80f}]]></GPODomainGuid><GPODomainController><![CDATA[dc.windomain.local]]></GPODomainController><BackupTime><![CDATA[2019-07-02T05:30:50]]></BackupTime><ID><![CDATA[{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}]]></ID><Comment><![CDATA[]]></Comment><GPODisplayName><![CDATA[Disable Windows Defender]]></GPODisplayName></BackupInst></Backups>
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/Backup.xml b/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/Backup.xml
deleted file mode 100755
index d5b772ce7..000000000
--- a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/Backup.xml
+++ /dev/null
@@ -1,18 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?><!-- Copyright (c) Microsoft Corporation.  All rights reserved. --><GroupPolicyBackupScheme bkp:version="2.0" bkp:type="GroupPolicyBackupTemplate" xmlns:bkp="http://www.microsoft.com/GroupPolicy/GPOOperations" xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations">
-    <GroupPolicyObject><SecurityGroups><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-535525547-1807146305-221323077-1000]]></Sid><SamAccountName><![CDATA[vagrant]]></SamAccountName><Type><![CDATA[User]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[vagrant@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-535525547-1807146305-221323077-519]]></Sid><SamAccountName><![CDATA[Enterprise Admins]]></SamAccountName><Type><![CDATA[UniversalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Enterprise Admins@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-535525547-1807146305-221323077-512]]></Sid><SamAccountName><![CDATA[Domain Admins]]></SamAccountName><Type><![CDATA[GlobalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Domain Admins@windomain.local]]></UPN></Group></SecurityGroups><FilePaths/><GroupPolicyCoreSettings><ID><![CDATA[{288D6F79-F949-4C97-BE07-8997DBE821BC}]]></ID><Domain><![CDATA[windomain.local]]></Domain><SecurityDescriptor>01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ab 78 eb 1f 41 dd b6 6b 45 1f 31 0d e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ab 78 eb 1f 41 dd b6 6b 45 1f 31 0d 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 ab 78 eb 1f 41 dd b6 6b 45 1f 31 0d 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00</SecurityDescriptor><DisplayName><![CDATA[Disable Windows Defender]]></DisplayName><Options><![CDATA[0]]></Options><UserVersionNumber><![CDATA[65537]]></UserVersionNumber><MachineVersionNumber><![CDATA[196611]]></MachineVersionNumber><MachineExtensionGuids><![CDATA[[{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}]]]></MachineExtensionGuids><UserExtensionGuids/><WMIFilter/></GroupPolicyCoreSettings> 
-        <GroupPolicyExtension bkp:ID="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" bkp:DescName="Registry">
-            <FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\registry.pol" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{288D6F79-F949-4C97-BE07-8997DBE821BC}\Machine\registry.pol" bkp:Location="DomainSysvol\GPO\Machine\registry.pol"/>
-            
-            <FSObjectFile bkp:Path="%GPO_FSPATH%\Adm\*.*" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{288D6F79-F949-4C97-BE07-8997DBE821BC}\Adm\*.*"/>
-        </GroupPolicyExtension>
-        
-        
-        
-        
-        
-        
-        
-        
-        
-    <GroupPolicyExtension bkp:ID="{F15C46CD-82A0-4C2D-A210-5D0D3182A418}" bkp:DescName="Unknown Extension"><FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\comment.cmtx" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{288D6F79-F949-4C97-BE07-8997DBE821BC}\Machine\comment.cmtx" bkp:Location="DomainSysvol\GPO\Machine\comment.cmtx"/></GroupPolicyExtension></GroupPolicyObject>
-</GroupPolicyBackupScheme>
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/registry.pol b/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/registry.pol
deleted file mode 100755
index 08a48aaaf6574e78b346646024e202b73aa36481..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 368
zcmcJK%?iRW5QIO$2k8s=1fB%1h0+QhjE7j$QqWY|K<V2%i9ZxPd)Vym?CfTyC|$b(
zPE_<X1STv44nra2Mn|o1j6(9%4Z_Da+i(=-xvHOpX6(gn6cKZ}1Y2R9W|oWYId+-_
zAr%ki?|+fEPVCnkRh|E+%TP*-m7)y?sky7m<T<(vs_Ue&m)2hgpUvnZ?&aF?s)O>N
K>}eNHmVTa<??BH0

diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/bkupInfo.xml b/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/bkupInfo.xml
deleted file mode 100755
index 0e7c0a5ed..000000000
--- a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/bkupInfo.xml
+++ /dev/null
@@ -1 +0,0 @@
-<BackupInst xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest"><GPOGuid><![CDATA[{288D6F79-F949-4C97-BE07-8997DBE821BC}]]></GPOGuid><GPODomain><![CDATA[windomain.local]]></GPODomain><GPODomainGuid><![CDATA[{d2ef48b7-bc16-4377-a67f-dbaab78aa80f}]]></GPODomainGuid><GPODomainController><![CDATA[dc.windomain.local]]></GPODomainController><BackupTime><![CDATA[2019-07-02T05:30:50]]></BackupTime><ID><![CDATA[{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}]]></ID><Comment><![CDATA[]]></Comment><GPODisplayName><![CDATA[Disable Windows Defender]]></GPODisplayName></BackupInst>
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml
new file mode 100644
index 000000000..b376e3d03
--- /dev/null
+++ b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/Backup.xml
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?><!-- Copyright (c) Microsoft Corporation.  All rights reserved. --><GroupPolicyBackupScheme bkp:version="2.0" bkp:type="GroupPolicyBackupTemplate" xmlns:bkp="http://www.microsoft.com/GroupPolicy/GPOOperations" xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations">
+    <GroupPolicyObject><SecurityGroups><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2801704331-839121494-1579986156-1000]]></Sid><SamAccountName><![CDATA[vagrant]]></SamAccountName><Type><![CDATA[User]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[vagrant@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2801704331-839121494-1579986156-519]]></Sid><SamAccountName><![CDATA[Enterprise Admins]]></SamAccountName><Type><![CDATA[UniversalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Enterprise Admins@windomain.local]]></UPN></Group><Group bkp:Source="FromDACL"><Sid><![CDATA[S-1-5-21-2801704331-839121494-1579986156-512]]></Sid><SamAccountName><![CDATA[Domain Admins]]></SamAccountName><Type><![CDATA[GlobalGroup]]></Type><NetBIOSDomainName><![CDATA[WINDOMAIN]]></NetBIOSDomainName><DnsDomainName><![CDATA[windomain.local]]></DnsDomainName><UPN><![CDATA[Domain Admins@windomain.local]]></UPN></Group></SecurityGroups><FilePaths/><GroupPolicyCoreSettings><ID><![CDATA[{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}]]></ID><Domain><![CDATA[windomain.local]]></Domain><SecurityDescriptor>01 00 04 9c 00 00 00 00 00 00 00 00 00 00 00 00 14 00 00 00 04 00 ec 00 08 00 00 00 05 02 28 00 00 01 00 00 01 00 00 00 8f fd ac ed b3 ff d1 11 b4 1d 00 a0 c9 68 f9 39 01 01 00 00 00 00 00 05 0b 00 00 00 00 00 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e e8 03 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e 00 02 00 00 00 02 24 00 ff 00 0f 00 01 05 00 00 00 00 00 05 15 00 00 00 8b 9d fe a6 56 fa 03 32 ec ac 2c 5e 07 02 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 09 00 00 00 00 02 14 00 94 00 02 00 01 01 00 00 00 00 00 05 0b 00 00 00 00 02 14 00 ff 00 0f 00 01 01 00 00 00 00 00 05 12 00 00 00 00 0a 14 00 ff 00 0f 00 01 01 00 00 00 00 00 03 00 00 00 00</SecurityDescriptor><DisplayName><![CDATA[Disable Windows Defender]]></DisplayName><Options><![CDATA[0]]></Options><UserVersionNumber><![CDATA[65537]]></UserVersionNumber><MachineVersionNumber><![CDATA[720907]]></MachineVersionNumber><MachineExtensionGuids><![CDATA[[{00000000-0000-0000-0000-000000000000}{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}][{35378EAC-683F-11D2-A89A-00C04FBBCFA2}{D02B1F72-3407-48AE-BA88-E8213C6761F1}][{B087BE9D-ED37-454F-AF9C-04291E351182}{BEE07A6A-EC9F-4659-B8C9-0B1937907C83}]]]></MachineExtensionGuids><UserExtensionGuids/><WMIFilter/></GroupPolicyCoreSettings> 
+        <GroupPolicyExtension bkp:ID="{35378EAC-683F-11D2-A89A-00C04FBBCFA2}" bkp:DescName="Registry">
+            <FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\registry.pol" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\registry.pol" bkp:Location="DomainSysvol\GPO\Machine\registry.pol"/>
+            
+            <FSObjectFile bkp:Path="%GPO_FSPATH%\Adm\*.*" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Adm\*.*"/>
+        </GroupPolicyExtension>
+        
+        
+        
+        
+        
+        
+        
+        
+        
+    <GroupPolicyExtension bkp:ID="{F15C46CD-82A0-4C2D-A210-5D0D3182A418}" bkp:DescName="Unknown Extension"><FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\comment.cmtx" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\comment.cmtx" bkp:Location="DomainSysvol\GPO\Machine\comment.cmtx"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Preferences" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\Preferences" bkp:Location="DomainSysvol\GPO\Machine\Preferences"/><FSObjectDir bkp:Path="%GPO_MACH_FSPATH%\Preferences\Registry" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\Preferences\Registry" bkp:Location="DomainSysvol\GPO\Machine\Preferences\Registry"/><FSObjectFile bkp:Path="%GPO_MACH_FSPATH%\Preferences\Registry\Registry.xml" bkp:SourceExpandedPath="\\dc.windomain.local\sysvol\windomain.local\Policies\{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}\Machine\Preferences\Registry\Registry.xml" bkp:Location="DomainSysvol\GPO\Machine\Preferences\Registry\Registry.xml"/></GroupPolicyExtension></GroupPolicyObject>
+</GroupPolicyBackupScheme>
\ No newline at end of file
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
new file mode 100644
index 000000000..2f2034cd8
--- /dev/null
+++ b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/Preferences/Registry/Registry.xml
@@ -0,0 +1,3 @@
+<?xml version="1.0" encoding="utf-8"?>
+<RegistrySettings clsid="{A3CCFC41-DFDB-43a5-8D26-0FE8B954DA51}"><Registry clsid="{9CD4B2F4-923D-47f5-A062-E897DD1DAD50}" name="EnableAmsi" status="EnableAmsi" image="10" changed="2020-12-02 21:13:55" uid="{7DF9C732-80E6-44B7-8803-5DFE6D7AAC8C}"><Properties action="C" displayDecimal="0" default="0" hive="HKEY_CURRENT_USER" key="SOFTWARE\Microsoft\Windows Script Host\Settings" name="EnableAmsi" type="REG_DWORD" value="00000000"/></Registry>
+</RegistrySettings>
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/comment.cmtx b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/comment.cmtx
old mode 100755
new mode 100644
similarity index 100%
rename from Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/DomainSysvol/GPO/Machine/comment.cmtx
rename to Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/comment.cmtx
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/registry.pol b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/DomainSysvol/GPO/Machine/registry.pol
new file mode 100644
index 0000000000000000000000000000000000000000..dc337571fea5bcefe55075112f965c3c4d264604
GIT binary patch
literal 1560
zcmdUv-EM+F5QUFPAH)~%33_EiO?qK9V(f)@L2><w3Jnm9Z|^tQHBHgW{tyDYdv<0y
zXLe@B6SwY2nk!VMl}a5IE0<HGG00w9CA>}r$gp1J;KiqPq&KisOV&rwt^#aVyoNbW
zk{-df?8SQLJf}W;B}k|bov!~gyNBBP@-<eAALJEj0+$#@JxyVAVAVylsVkW$HOCCD
zO$FZ5RG8lopOksYm@}qYe^K)P^*o_rLo6z|n}W9MdC`b0o87(5w&dA}OzM+~3HMX*
z+{@0k=m}90qserAuc2o!-ywd#7kFmPTK79v-&WVJ+=X>XtCO7upw`ohKd5)ltjXD8
Vdw^kejc8E!r3&18c|EsdeFk?N6QlqD

literal 0
HcmV?d00001

diff --git a/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml
new file mode 100644
index 000000000..6d0643d04
--- /dev/null
+++ b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/bkupInfo.xml
@@ -0,0 +1 @@
+<BackupInst xmlns="http://www.microsoft.com/GroupPolicy/GPOOperations/Manifest"><GPOGuid><![CDATA[{87738413-6EB8-4AB6-ABA7-F8DFADB92E11}]]></GPOGuid><GPODomain><![CDATA[windomain.local]]></GPODomain><GPODomainGuid><![CDATA[{535d6ef4-51ff-40f0-bc21-076a19ea0caa}]]></GPODomainGuid><GPODomainController><![CDATA[dc.windomain.local]]></GPODomainController><BackupTime><![CDATA[2020-12-02T21:14:06]]></BackupTime><ID><![CDATA[{F2150233-4B8F-4347-8D70-23D3984D9B78}]]></ID><Comment><![CDATA[]]></Comment><GPODisplayName><![CDATA[Disable Windows Defender]]></GPODisplayName></BackupInst>
diff --git a/Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/gpreport.xml b/Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/gpreport.xml
old mode 100755
new mode 100644
similarity index 53%
rename from Vagrant/resources/GPO/disable_windows_defender/{A1B5F23F-DC23-4225-98D0-22FD4EAF312C}/gpreport.xml
rename to Vagrant/resources/GPO/disable_windows_defender/{F2150233-4B8F-4347-8D70-23D3984D9B78}/gpreport.xml
index 9a2740adc9809ca2e4aac7999bb31af012b13ee1..86dd38461ace4f136177648df1fafc5ea4d05275
GIT binary patch
literal 30544
zcmeI5YfoE88pr4LO8XtGzS>Glz>p9iUMk0sG}<Oam^9l}q>6A!*l<ZPG>xi$_1*pd
z=E-#CoHO=0CdSazvV7s3xjeUdZu89HfB)^cZ`?2L#2veq``I11b2o5D?#!LKf4Hw)
z+ud;s`flmYsoT@_ece5EZ~Wa$ci|4*oLVib%{Ok{{nh=&b=+h3+-<3kjeDvQ*Yta!
zzKr=+y)N8)U7OeIgMZ!8=aS|+)BJCAby2e}Xxw@CFZa}a=lYuatzbBDyB?bI$VU?y
zdCucD5Olj9+k?_v!=XP>&pp9@CM?fHlMCSjwN8Y=V}Jcp7(dsQW8d<luJ?rxlrVY@
zG?&q@CCYW&6HyDAbN^6pI1}#=Z<A7evheP>kHX<V7y{|9ZpGc#Yf0aC#i=F9!Lr+Q
z5B2w)u5|TlS-<%1s@<G>q&pk>?CSHOTNRHt)vxV-6Snh>@ZInf-Srfk7M>scZ2QT~
zcf`Xpad%hWK%PPsIaH5R$34>+C!*-O#yApPcin4^c_9A3{C(CBy57?L14#k$fK;6O
zd1G%@U62S?>9M=??Rp++W<ZVxn&(1&FZH)UH@a;cwWnSOg6=|}`))_D8Pu#&-e`cf
zJ{QIJ9sRwmwcQrC*CZ9oey(97#5tY{R&<NW`mk9RH4Ag@=-u|SEa~%}USKqQj5yD>
z$E5lAcQrm3-4Sj}nsdoZ{i6G~pRqbxoQd_lCu*Mys|&3icsS4%{(i43=(;E`#=pK=
zZAjluL%K}^r4X{Nw}fxsb97Erg{Q{Z6;Yur+!s6@pv0Uwyrgy9_HFL!*InQ5o?5Ny
zwIZsuH3nLst$w^7YxE8GLhm(c!>(5S-!x;_J#an!=5t%0NZGC^b*S$Zea`89sI`HP
zLDKg1p3~pxoqhdc<Xye@H0!eOvFagvps~7|?Q6}#9E{)7+&xjaCoErTw&(hMu4_BG
zwxw$uy4KUR4ZXK~p9j}Sj{sS~{wmOI2)9X$GkLDx6Mt4qut9mK4z-~)TzMc%u+gYp
z%FWNAS>OFonD2?__0^=Kr@miHM%Kg!ljj%02<V;&tG<^!WDJ=C*F(wXf@FM261=Ci
zGbb7$-$9QC>0Z_qB;Hoef?BW!(Wv*;udR_75zcQ(#>0$TrCE#fz1F-}pYOF`V1?b+
zYTNbNVL|Kf;L{3cErP?Ya9a6vmvza?1a36Ps#-5z5pwjvRVg)T$gws-SC@78mVDV$
z;dy?8T0B@GtV*yfNaHl@3RYzDx+GW-qdd42>26pCpJ-ZmzSL@aCRn!Qd$9VSxmSv!
zb``^%>l3dFcmq^Lh`AGGrF<_&4b#9S?+bi+QiMfX@;vE#Jz1ps?UA80rf5mK54=7Z
z)JRj5nIc{tSs(NfQR+Z1i|+@zieJyzNb1eWSsIlzfwUQRH-}Gk-8>P6$zND3Fi;ds
zuHZx**!4Vs{_C=?#FX#@-O#L0b*>$ac&Sl{)((bnzDPl{5o8^Tee<nu+McYAT)z>Q
zpmnDq2iUx4qFzf@;Dx@wm1f@-2Y2LWzLIy#y-n};a<#AD#Prc>wB#>t`BvNd{!TAi
z_eZSvi08b<PC1_E8oagq4fH?<tVu%b3VEX3x(hwPt}JJ9{!u;GMUP{>&g2sz)1%ww
z=Ac)ABM$|+vUGJ3J&s;W)*?S!SF!nfK}<f6e9V#m4W;t4+iKVmhQ#~FTEoRGOYu%_
z&NxEI5Llka{D&>U@E?u5CvK6!De4GDZ_;c0dC482l`Pwa<|^lphRvPtSqH(9*Mnf0
z!)KsXaVqM<g&YN%_s+qAjE&3pj`(ePVsaJdUgmOR8+R=u9_=#{*cDIr#91uzrm(w|
zJy_SOC)2j?S4;C=xtYPL8H}9*EKfE6z`YYJ3m%FT&Umjpqpj0a59QW6GF0tZ)L%{e
zg>{q8Ssk5L*3vw_X<36b0wNb`+{ni*5ysnNv&fM2z14c^VGoeyDO~0Luy#S0&#chQ
z3Prge&z4+xf5*J!@p_hZPZ@&dcI3;pLYuNc>{|R?x|0kayHdmx{Cy(Nz;<dr>Mx>|
zbPoYdFtb}R#vZN*Z@=A|%-#<<m&IFZ|8n`eV(z6YStoBo6$7$8vxC8c50mU!G{!FP
zs2Hx!3fVq!Izm3Cn%Ti<zneumv=8-3O`@@x9W3XJtE;}8HT)9exArZyU&C{bUF8!l
ze9oCHj%Bl~ey7=fLR?w1{Nl`_%`6%_Wlge^Iopokcw6#|0S;ofXaQTw%*Wc)SqxX)
zC#~8%^COCR%X}+qd2_kP$;5C?sxP9&2r<&Ma;>>2u4xrUgnDM@W_E5`b}pAaY#R0D
zEKJZx>;}$qn6{HPi`{0i+obB(t&$nPXjt7?v?I5{`mvu(w0Evr25OGT(o>r<%Vh>W
zkq4Spmdq+k{ydc>GkZAN9-<GL<Swa};d~wYqwEX4QLo!kM_cqNM?)E-RkLcvUEENE
zl|QT2QT-})ab{sQR4+s&RM%I&b3L46ELOrb?Gyalj%p&Qk$vwonb@)jv-!K<dkYu#
zT2s%Lvvt&paas)g>RX0cb0haP)<D>iAsIGiu}yI_tZ|?TwTbDzP5EBA=P#bh>^@r6
zcA$2V76$dEDm&pxY@J5nYwjmeW3p$0sd-G#Fwg5u5^I9<vYcF<_w{UVbd7psc=DC}
zkX-#Ku&q^Em&YGgiQ4hF)%R~Hhew6=ksyQ;ze;MCBxgNIbkCnBoKpn#NbiR_ZN!OB
zJLkm7<wbwaX+d{4RnNr<=6h<v={vl`-~6fQlzY+Bz}Lv*SA}O)aBOJYhnnw^zB%)>
zC^$AeJoi=o$f?Y(YV($Lea^$OsuNk98*S^&>FRsB3p_0^cbwG)*HqHFT31kkHgJX&
zOwIVHcAWa<WQ&bPMu^^=%coM6>qgV`RB$-2+Y+qB^SboCO!xo>kA!PaxGZ_hIPJFS
zX@1w!gEQnSdfBPCd%ivQH`Jr6S5NnPHGHsjV!W^_m7;`gNk*x6LD!h(Xx4TZ-_!Z9
z5@*t8jE?0X-fxL^WR>F+7kZwmSeJpXL*CVzK^yPs3iLnrJTlq?DLVgBS1*$5Z`GD(
zIl#?t-9JUeAKZ_k%?qusZT-cr(U1CzI`nNn-#fMb=-c;IY5Pd`Uy7o%eWjC4<!2kb
zDy{OCMvCW}Tbh&SAY7<#k-9uNpqWfkZw;lu04N>{UOSPyt#3vlzsEUuYZJ~$hVNl|
zBDW^L|9vF*F)z-K=H~pTwVdN;U0;)?)DqUsiS^3sj{IE1+n0G!?N8sT4av0&G46Ur
z5~yEJ^*v+8)+uH4v*qnuCj(c$rLDLs7G+Dg=w&PaEE4=g<oR=+<}r@tTl`GRNB?yH
zrpmD(_t+s?M~>`h4V_DWw}dUHkefYwqC85<*D#lH!dhB&2ENI<IGK7wCa=Jhwy7Hr
z{&GsgPA9BOU!n6@OYen8c*crVCr1CIC7op0(y}SOcf3AGA$sEJ^id;RY8?En;N3Ap
z6G*6|EP6`SXM9k3d8W~U^;Ew&p-0W&sjtGs=I-mtp6;YRGOg`QS?ontoA#Varq7}J
za5~xS$%o(D+f`<=vuZ|7^C+=VXk5-<V7X7_-`NQj8#6rjCX7}`HM4M$ZZ<a<N4UZ5
zRL~wtqrf+ESk3AC+Cy5jkxi&>G&VZc)3_;Z1HUFk-MDVbYax}?{95E$M64715V*%F
zEu@PoU(SB;yDXjG`}KvV7-#N_E9H^uX76bPW_{!5Cq^sJ6rw(O&)VYLQ#r1vu9gT@
zb%q>Fv3<Sf3|h0kWvcU{j^(*Dr=s75$C>p<l#Db7sUS;xCYo?+{KQ{3ukdHzixtNR
zElD&whqYT?_Yt2sZw~Ji!c^lDJ;x^y+4-ZY?yeiLEQ?L`vS}8J83UHAb+kcF3s8d|
zDQa1msMp4)Z=JR(>iF?>)j-^ib|_TQPZEQc^f6L(EQ;}zkD^`L*Yk_uUCO_r6)WrG
zsAq2i_98SuALY9&V<}FP(|35w=RS&JwGq>{^_jEVE4ptIQPyPJ@=GGzw@F)?cgm`p
zlU&;Kyr=;}3!$B3Od8?8eR`Fs6Ag+UHOaTU6DLK_bPd~Y{*LL})TU#Fux8{h;uF#$
zwtogK8hw|t2Avc=>$J|~_3HKGG)+x=6WGjjulYSyeOK1+SMyZA4BcDJ8xWtBEsFWI
z!z{|xbnK=yeux{V?WgAQ2Tk!Nn#R5otrOEkfAyU(!uQ3Jm1A;jSdo5Jom!U54fRQ%
z7Ham<^3Kc~G8Z3woS&Q3{25|I=C%_AW)qr4|ICPe<%zukTl40zG(?!e!VneVVe;gR
z;73_Yi^J<9pDI0yo^8>_M86j7hGmL!eqNQT(c=#JnUuq1Nx+OJXM|V=yvemgpXg(8
z-{QM^?hnTH<j0RzCP|s;P$c?o(}@mldp6|DvoUBX;#zha$%>d%=kfqi7OrMr{#coi
zW;7X3M~<&CsyTvYa81*fzA8jBe|Y8(r+K9`gBmqV>JOu<%<hHfJFydGxe9WAR7)WF
z?6Q#Kw*R}p?oKlgx}`Dj8B)(C^@Jl-^|>)T68yCCGw9Rt(mZk9h-LeGT^Zo!^c|nB
z!OOSo5uVu{Q9EJ+-;TxM=-0v93!h7>dhqa>{p7bAgIqS%8f2x+3uX@{%EITv${z0Y
zwLSjqaG9@adDei{Pnz^WkFXv-p9b&?IZb7?7!wqAdb+DvwPZ~(3o!t8h823<7)C#*
zyyjB8Q_U6jv2vN{u9w46JAi%RHOq*fCK>%|hA2n*$fx@K!@!~XmU%1G|72y@Lnm+W
z!TZVYB#&WF%${On7X8m)C#rTgR6h)-5ZeBUUk_$yvCFpKYC8pCUx8c#`YUEsiuDVr
zeIBl3>U34JQOH;f$Ed1-BVDj^bug6m<s>46X3!S3Y8mRdwq`moR$cQnVaqe(yC6T!
zYA86}W?pKf>uuI?tV=Qg)PjcpoU|_+W!0}=vZf<Xc&ay5*THi_8)2bC7B#FK%ch2v
z6SK~iYs51pn?kM<pVa<)S*YT|ud^Dc`id{}c}&j%6&lk{A)5RF7dhTKuA#{Wg2y~&
z>XCS2O<xu9z)sEI!28lEr|FaWk3btEEj+kG?{^>TSD-|l&TFoB>oBU*zEt{A)e|B^
zXilCzR6z&IHHG{-wDmYR2FWu|I6#di!p|?`n&(YRb>E{`w?$geiAbtg`!agYpG0ls
z9=|BGjFQgNEEy3E8t>04P_X%vtJk}JTZ0Y5E3h4`aDJ*<8=d|iK4fmP)$2eJtT9jI
zLPJLwI?`;mM-;D_XJ3C}?K)1j0c~;SNuO(DhAPe-{l^2e-#bxbM=P&P4Nj#zO{&(@
zSk&x%xkVa@@vL_G^WQeGlIyY+%!ap)736pNUmcOn80)6v#}SI-Z)$|#gN%2=@0noO
z`ji300uWmiPYC8)g!!T8Fxrhv)t7?h-1ES)f_5q?#Xlc0j!)nEnf^GGh68q%Y~B4I
DBO<AA

delta 1067
zcmcccj`7Z1#tk-1o<<B7K<L6?#^A<a&S1%)3#2U>Ou#G?24^5`4is}@aAhz6vn+rj
zATbxPm<59ogCUUR%uqWyl396jfFsN1HB8eO6%D}#K(rVD6@>t`8#7ojm;z}lAU2tt
z%;Jhwl_^l(7_7>W!D8}B7JGASW+7CW0v(_SR1dNX<N*sH8O313pg;K|i}2(i)@#<L
zK=Vw2&<ISL0OfUodMv;?41r!X1KVc`6g2{S#~4V0TmUq0aw^+piu9MVucSo(=4cLn
z7K#j5&cn$>kpXY{jx$e|Q($wZAQ*u`3yLPo$s2iOCmRTHO}@a>viXLo3G3triDw|g
zDRJTC<vi+8L)UC}kSb%^Tw$2Sym^bzCN@fq-khj#oNaT4<Tkd=YU<ZmH}hCuVPrI(
zytg<INb;8?PhL~TF?o%P-{cRrNt0t-wI=u2xlCs9R+{|5foJlR7_rHGZaR#HlP`K}
zPI6|MoZ+Sb<S6=RgE%R<7Mnk~U0?!=9Q4!&iG1;N19CokicfCvmjMY}@e-P>7wX0i
zOv?;~3_xSN^nnT(A%>ya!Zz6_Ob;lD%O->HdCUZDDgzk+wL@_-pNq+6fno<10QXbQ
A5dZ)H

diff --git a/Vagrant/resources/windows/Microsoft.PowerShell_profile.ps1 b/Vagrant/resources/windows/Microsoft.PowerShell_profile.ps1
index 0da238869..5d6b30db7 100644
--- a/Vagrant/resources/windows/Microsoft.PowerShell_profile.ps1
+++ b/Vagrant/resources/windows/Microsoft.PowerShell_profile.ps1
@@ -1,5 +1,3 @@
-Write-Host "Invoke-AtomicTest has been loaded."
-Write-Host "Learn more about atomic tests here: https://git.io/Jed0L"
-Write-Host ""
 Import-Module "C:\Tools\Atomic Red Team\atomic-red-team-master\execution-frameworks\Invoke-AtomicRedTeam\Invoke-AtomicRedTeam\Invoke-AtomicRedTeam.psm1"
-$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\Tools\Atomic Red Team\atomic-red-team-master\atomics"}
\ No newline at end of file
+$PSDefaultParameterValues = @{"Invoke-AtomicTest:PathToAtomicsFolder"="C:\Tools\Atomic Red Team\atomic-red-team-master\atomics"}
+$env:Path += ";c:\Program Files\osquery"
\ No newline at end of file
diff --git a/Vagrant/scripts/configure-disable-windows-defender-gpo.ps1 b/Vagrant/scripts/configure-disable-windows-defender-gpo.ps1
index fd5cf8470..793974288 100644
--- a/Vagrant/scripts/configure-disable-windows-defender-gpo.ps1
+++ b/Vagrant/scripts/configure-disable-windows-defender-gpo.ps1
@@ -1,4 +1,4 @@
-# Purpose: Install the GPO that disables Windows Defender
+# Purpose: Install the GPO that disables Windows Defender and AMSI
 Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Importing the GPO to disable Windows Defender..."
 Import-GPO -BackupGpoName 'Disable Windows Defender' -Path "c:\vagrant\resources\GPO\disable_windows_defender" -TargetName 'Disable Windows Defender' -CreateIfNeeded
 
diff --git a/Vagrant/scripts/install-evtx-attack-samples.ps1 b/Vagrant/scripts/install-evtx-attack-samples.ps1
index 71d987036..ef1734db1 100644
--- a/Vagrant/scripts/install-evtx-attack-samples.ps1
+++ b/Vagrant/scripts/install-evtx-attack-samples.ps1
@@ -67,7 +67,7 @@ sourcetype = preprocess-winevt'
         } Catch {
           Start-Sleep 10
           Stop-Service -Name SplunkForwarder -Force
-          Start-Service -Name SplunkForwarder -Force
+          Start-Service -Name SplunkForwarder
         }
         Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Done! Look in 'index=EVTX-ATTACK-SAMPLES' in Splunk to query these samples."
     }
diff --git a/Vagrant/scripts/install-splunkuf.ps1 b/Vagrant/scripts/install-splunkuf.ps1
index ed9f15f5b..10659e044 100755
--- a/Vagrant/scripts/install-splunkuf.ps1
+++ b/Vagrant/scripts/install-splunkuf.ps1
@@ -2,17 +2,17 @@
 
 If (-not (Test-Path "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe")) {
   Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Downloading Splunk Universal Forwarder..."
-  $msiFile = $env:Temp + "\splunkforwarder-7.1.0-2e75b3406c5b-x64-release.msi"
+  $msiFile = $env:Temp + "\splunkforwarder-8.1.0.1-24fd52428b5a-x64-release.msi"
 
   Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Installing & Starting Splunk"
   [Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls"
-  (New-Object System.Net.WebClient).DownloadFile('https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=windows&version=7.1.0&product=universalforwarder&filename=splunkforwarder-7.1.0-2e75b3406c5b-x64-release.msi&wget=true', $msiFile)
-  Start-Process -FilePath "c:\windows\system32\msiexec.exe" -ArgumentList '/i', "$msiFile", 'RECEIVING_INDEXER="192.168.38.105:9997" WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 WINEVENTLOG_APP_ENABLE=0 AGREETOLICENSE=Yes SERVICESTARTTYPE=1 LAUNCHSPLUNK=1 SPLUNKPASSWORD=changeme /quiet' -Wait
-} Else {
+  (New-Object System.Net.WebClient).DownloadFile('https://www.splunk.com/bin/splunk/DownloadActivityServlet?architecture=x86_64&platform=windows&version=8.1.0.1&product=universalforwarder&filename=splunkforwarder-8.1.0.1-24fd52428b5a-x64-release.msi&wget=true', $msiFile)
+  Start-Process -FilePath "c:\windows\system32\msiexec.exe" -ArgumentList '/i', "$msiFile", 'RECEIVING_INDEXER="192.168.38.105:9997" WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 WINEVENTLOG_APP_ENABLE=0 AGREETOLICENSE=Yes SERVICESTARTTYPE=AUTO LAUNCHSPLUNK=1 SPLUNKPASSWORD=changeme /quiet' -Wait
+}
+Else {
   Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Splunk is already installed. Moving on."
 }
-If ((Get-Service -name splunkforwarder).Status -ne "Running")
-{
+If ((Get-Service -name splunkforwarder).Status -ne "Running") {
   throw "Splunk forwarder service not running"
 }
 Write-Host "$('[{0:HH:mm}]' -f (Get-Date)) Splunk installation complete!"