Add a check for Office Protected View settings

data/Checks.csv

@@ -58,6 +58,7 @@
 "HARDEN_DEFAULT_LOCAL_ADMIN",      "Invoke-DefaultLocalAdministratorAccountCheck","TA0008 - Lateral Movement",     "Hardening - Default Local Administrator Account",  "Low",      "List",   "Audit",        "True",       "False", "Check whether the default local administrator account is disabled."
 "HARDEN_CLICKONCE_PROMPT",         "Invoke-ClickOnceTrustPromptBehaviorCheck",    "TA0001 - Initial Access",       "Hardening - ClickOnce Trust Prompt Behavior",      "Low",      "List",   "Audit",        "True",       "False", "Check whether users are allowed to execute ClickOnce applications from the 'Internet' zone."
 "HARDEN_OFFICE_MACROS",            "Invoke-OfficeMacroConfigurationCheck",        "TA0001 - Initial Access",       "Hardening - MS Office Macro Settings",             "Low",      "List",   "Audit",        "True",       "False", "Check whether Office macros are enabled or disabled with a notification."
+"HARDEN_OFFICE_PROTECTED_VIEW",    "Invoke-OfficeProtectedViewConfigurationCheck","TA0001 - Initial Access",       "Hardening - MS Office Protected View Settings",    "Low",      "List",   'Audit",        "True",       "False", "Check whether Office Protected View is enabled on all supported applications."
 "CONFIG_PATH_FOLDERS",             "Invoke-DllHijackingCheck",                    "TA0004 - Privilege Escalation", "Configuration - PATH Folder Permissions",          "High",     "List",   "Base",         "False",      "False", "Check whether the current user has any write permissions on the system-wide PATH folders. If so, the system could be vulnerable to privilege escalation through ghost DLL hijacking."
 "MISC_HIJACKABLE_DLL",             "Invoke-HijackableDllCheck",                   "TA0004 - Privilege Escalation", "Misc - Known Ghost DLLs",                          "None",     "List",   "Base",         "False",      "False", "Get information about services that are known to be prone to ghost DLL hijacking. Note that their exploitation requires the current user to have write permissions on at least one system-wide PATH folder."
 "CONFIG_CREDENTIAL_DELEGATION",    "Invoke-CredentialDelegationCheck",            "TA0006 - Credential Access",    "Configuration - Credential Delegation",            "Medium",   "List",   "Extended",     "True",       "False", "Check whether Credential Delegation is enabled. If so, passwords are very likely to be stored in clear-text in memory, unless another setting prevents that. Note that LSA Protection is not sufficient to protect credentials in this case."

info/CHANGELOG.md

@@ -6,6 +6,7 @@
 
 - Add a helper function for enumerating Microsoft Office Trust Center security settings.
 - Add a check for Microsoft Office macro execution settings.
+- Add a check for Microsoft Office Protected View settings.
 
 ## 2026-01-28
 

src/check/Hardening.ps1

@@ -1314,6 +1314,79 @@ function Invoke-OfficeMacroConfigurationCheck {
             $AllResults += $MacroSetting
         }
 
+        $CheckResult = New-Object -TypeName PSObject
+        $CheckResult | Add-Member -MemberType "NoteProperty" -Name "Result" -Value $AllResults
+        $CheckResult | Add-Member -MemberType "NoteProperty" -Name "Severity" -Value $(if ($GlobalVulnerable) { $BaseSeverity } else { $script:SeverityLevel::None })
+        $CheckResult
+    }
+}
+
+function Invoke-OfficeProtectedViewConfigurationCheck {
+    <#
+    .SYNOPSIS
+    Check whether Office Protected View is enabled on all supported applications
+
+    Author: @itm4n
+    License: BSD 3-Clause
+
+    .DESCRIPTION
+    This cmdlet checks whether all three Protected View parameters are enabled (default) in Word, Excel and PowerPoint.
+
+    .EXAMPLE
+    PS C:\> Invoke-OfficeProtectedViewConfigurationCheck
+
+    Application : Word
+    Version     : 16.0
+    Key         : HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Word
+    Value       : DisableInternetFilesInPV
+    Data        : 0
+    Description : Protected View for files originating from the Internet is enabled (default)
+    Vulnerable  : False
+
+    Application : Excel
+    Version     : 16.0
+    Key         : HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Excel
+    Value       : DisableInternetFilesInPV
+    Data        :
+    Description : Protected View for files originating from the Internet is enabled (default)
+    Vulnerable  : False
+
+    Application : PowerPoint
+    Version     : 16.0
+    Key         : HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\PowerPoint
+    Value       : DisableInternetFilesInPV
+    Data        :
+    Description : Protected View for files originating from the Internet is enabled (default)
+    Vulnerable  : False
+    #>
+
+    [CmdletBinding()]
+    param (
+        [UInt32] $BaseSeverity
+    )
+
+    process {
+        $AllResults = @()
+        $GlobalVulnerable = $false
+
+        $ProtectedViewSettings = Get-MicrosoftOfficeTrustCenterConfiguration | Where-Object {
+            ($_.Value -eq "DisableInternetFilesInPV") -or ($_.Value -eq "DisableUnsafeLocationsInPV") -or ($_.Value -eq "DisableAttachmentsInPV")
+        }
+
+        foreach ($ProtectedViewSetting in $ProtectedViewSettings) {
+
+            $Vulnerable = $false
+
+            if (($null -ne $ProtectedViewSetting.Data) -and ($ProtectedViewSetting.Data -eq 1)) {
+                $Vulnerable = $true
+            }
+
+            if ($Vulnerable) { $GlobalVulnerable = $true }
+
+            $ProtectedViewSetting | Add-Member -MemberType "NoteProperty" -Name "Vulnerable" -Value $Vulnerable
+            $AllResults += $ProtectedViewSetting
+        }
+
         $CheckResult = New-Object -TypeName PSObject
         $CheckResult | Add-Member -MemberType "NoteProperty" -Name "Result" -Value $AllResults
         $CheckResult | Add-Member -MemberType "NoteProperty" -Name "Severity" -Value $(if ($GlobalVulnerable) { $BaseSeverity } else { $script:SeverityLevel::None })