Windows 又曝两个零日：BitLocker 被 USB 一击绕过，SYSTEM 提权紧随其后

# 查看当前 BitLocker 状态
manage-bde -status C:

# 如果当前仅使用 TPM，添加 PIN 保护器
# 先创建 PIN（示例：变量 $pin 在交互式输入时使用）
$pin = Read-Host -AsSecureString -Prompt "输入 BitLocker PIN"
Manage-BDE -Protectors -Add C: -TPMAndPIN $pin

# 确认保护器列表
manage-bde -protectors -get C:

# 禁用 USB 存储驱动（需管理员权限）
# 方法一：通过 Group Policy 注册表项
$regPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\RemovableStorageDevices"
if (-not (Test-Path $regPath)) { New-Item -Path $regPath -Force }
New-ItemProperty -Path $regPath -Name "Deny_All" -Value 1 -PropertyType DWord -Force

# 方法二：直接禁用 usbstor 驱动
# 查找 usbstor.inf 对应的类 GUID
$usbstorPath = "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR"
Set-ItemProperty -Path $usbstorPath -Name "Start" -Value 4 -Type DWord

# 验证：插入 USB 存储设备应无法识别
# 恢复命令（需要时）：
# Set-ItemProperty -Path $usbstorPath -Name "Start" -Value 3 -Type DWord

# 检查当前保护器中是否包含 RecoveryPassword
$protectors = manage-bde -protectors -get C:
$protectors | Select-String "Recovery Password"

# 强制备份恢复密钥到 Entra ID（适用于 Azure AD 加入的设备）
# 需要设备已加入 Entra ID
BackupToAAD-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (Get-BitLockerKeyProtector -MountPoint "C:" | Where-Object KeyProtectorType -eq RecoveryPassword).KeyProtectorId

# 对于 AD 备份，确认 GPO 已配置：
# Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption
// > Choose how BitLocker-protected operating system drives can be recovered
// > Save BitLocker recovery information to Active Directory Domain Services

# 提权异常快速检查脚本（保存为 check-privilege-abuse.ps1）
# 可加入计划任务每 30 分钟运行一次

$suspiciousPatterns = @(
    "cmd.exe",    # SYSTEM 下意外出现的 cmd
    "powershell.exe", # SYSTEM 下意外出现的 PowerShell
    "whoami.exe",     # SYSTEM 下执行 whoami（提权验证行为）
    "net.exe",        # SYSTEM 下执行 net user/group 操作
    "psexec.exe"      # PsExec 远程执行
)

$systemProcesses = Get-Process | Where-Object {
    try {
        $owner = (Get-WmiObject Win32_Process -Filter "ProcessId=$($_.Id)").GetOwner()
        $owner.User -eq "SYSTEM"
    } catch { $false }
}

$alerts = $systemProcesses | Where-Object {
    $_.ProcessName -in $suspiciousPatterns
}

if ($alerts) {
    $body = $alerts | ForEach-Object {
        "进程: $($_.ProcessName) | PID: $($_.Id) | 时间: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
    } | Out-String
    # 写入本地日志
    Write-EventLog -LogName Application -Source "PrivilegeMonitor" -EntryType Warning -EventId 9001 -Message $body
    # 也可发送邮件或 webhook 通知
    Write-Warning "检测到可疑 SYSTEM 进程: $body"
} else {
    Write-Output "$(Get-Date) - 未检测到可疑 SYSTEM 进程"
}

# 注册自定义事件日志源（首次运行需执行一次）
if (-not (Get-EventLog -LogName Application -Source "PrivilegeMonitor" -Newest 1 -ErrorAction SilentlyContinue)) {
    New-EventLog -LogName Application -Source "PrivilegeMonitor"
}

# 创建计划任务每 30 分钟运行
$action = New-ScheduledTaskAction -Execute "powershell.exe" -Argument "-NoProfile -ExecutionPolicy Bypass -File C:\Scripts\check-privilege-abuse.ps1"
$trigger = New-ScheduledTaskTrigger -Once -At (Get-Date) -RepetitionInterval (New-TimeSpan -Minutes 30)
Register-ScheduledTask -TaskName "PrivilegeAbuseMonitor" -Action $action -Trigger $trigger -User "SYSTEM" -RunLevel Highest