mirror of
https://github.com/sbousseaden/EDRUnChoker
synced 2026-06-21 14:09:16 +00:00
Samirbous
9d28f642d9
Plain WMI ExecQuery missed ActiveStore policies from New-NetQosPolicy and EDRChoker; enumerate ActiveStore and GPO:localhost with SWbemNamedValueSet and align status checks with Get-NetQosPolicy.
55 lines
1.9 KiB
PowerShell
55 lines
1.9 KiB
PowerShell
#Requires -RunAsAdministrator
|
|
#Requires -Version 5.1
|
|
<#
|
|
.SYNOPSIS
|
|
Removes the fileless EDRChoker WMI defense subscription.
|
|
#>
|
|
[CmdletBinding()]
|
|
param(
|
|
[string]$FilterName = 'EDRChokerDefense_QoSFilter',
|
|
[string]$ConsumerName = 'EDRChokerDefense_QoSConsumer',
|
|
[string]$TimerId = 'EDRChokerDefense_Timer'
|
|
)
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$WmiNs = 'root\subscription'
|
|
$LogSource = 'EDRChokerDefense'
|
|
$LogName = 'Application'
|
|
|
|
function Remove-WmiSubscriptionComponent {
|
|
param(
|
|
[string]$Class,
|
|
[string]$Filter
|
|
)
|
|
|
|
$instance = Get-WmiObject -Namespace $WmiNs -Class $Class -Filter $Filter -ErrorAction SilentlyContinue
|
|
if ($instance) {
|
|
$instance | Remove-WmiObject
|
|
Write-Host "Removed $Class ($Filter)"
|
|
}
|
|
}
|
|
|
|
$bindings = @(Get-WmiObject -Namespace $WmiNs -Class __FilterToConsumerBinding -ErrorAction SilentlyContinue |
|
|
Where-Object { $_.Filter -match [regex]::Escape($FilterName) -or $_.Consumer -match [regex]::Escape($ConsumerName) })
|
|
|
|
foreach ($binding in $bindings) {
|
|
$binding | Remove-WmiObject
|
|
Write-Host 'Removed __FilterToConsumerBinding'
|
|
}
|
|
|
|
Remove-WmiSubscriptionComponent -Class CommandLineEventConsumer -Filter "Name='$ConsumerName'"
|
|
Remove-WmiSubscriptionComponent -Class ActiveScriptEventConsumer -Filter "Name='$ConsumerName'"
|
|
Remove-WmiSubscriptionComponent -Class __EventFilter -Filter "Name='$FilterName'"
|
|
Remove-WmiSubscriptionComponent -Class __IntervalTimerInstruction -Filter "TimerId='$TimerId'"
|
|
|
|
if ([System.Diagnostics.EventLog]::SourceExists($LogSource)) {
|
|
try {
|
|
Write-EventLog -LogName $LogName -Source $LogSource -EventId 1001 -EntryType Information -Message 'action=uninstall subscription=EDRChokerDefense'
|
|
}
|
|
catch {
|
|
Write-Warning "Could not write uninstall event: $($_.Exception.Message)"
|
|
}
|
|
}
|
|
|
|
Write-Host 'Uninstall complete. WMI subscription removed; past Application log events retained for SOC.'
|