ConvertTo WDACPolicy

ConvertTo-WDACPolicy available parameters

Syntax

ConvertTo-WDACPolicy
    [-PolicyToAddLogsTo <FileInfo>]
    [-Source <String>]
    [-SuppPolicyName <String>]
    [-Level <String>]
    [-MDEAHLogs <FileInfo[]>]
    [-EVTXLogs <FileInfo[]>]
    [-FilterByPolicyNames <String[]>]
    [-TimeSpan <String>]
    [-TimeSpanAgo <UInt64>]
    [-KernelModeOnly]
    [-LogType <String>]
    [-Deploy]
    [-ExtremeVisibility]
    [<CommonParameters>]

ConvertTo-WDACPolicy
    [-BasePolicyFile <FileInfo>]
    [-Source <String>]
    [-SuppPolicyName <String>]
    [-Level <String>]
    [-MDEAHLogs <FileInfo[]>]
    [-EVTXLogs <FileInfo[]>]
    [-FilterByPolicyNames <String[]>]
    [-TimeSpan <String>]
    [-TimeSpanAgo <UInt64>]
    [-KernelModeOnly]
    [-LogType <String>]
    [-Deploy]
    [-ExtremeVisibility]
    [<CommonParameters>]

ConvertTo-WDACPolicy
    [-BasePolicyGUID <Guid>]
    [-Source <String>]
    [-SuppPolicyName <String>]
    [-Level <String>]
    [-MDEAHLogs <FileInfo[]>]
    [-EVTXLogs <FileInfo[]>]
    [-FilterByPolicyNames <String[]>]
    [-TimeSpan <String>]
    [-TimeSpanAgo <UInt64>]
    [-KernelModeOnly]
    [-LogType <String>]
    [-Deploy]
    [-ExtremeVisibility]
    [<CommonParameters>]

Description

This is a multi-purpose cmdlet that offers a wide range of functionalities that can either be used separately or mixed together for very detailed and specific tasks.

It currently supports Code Integrity and AppLocker logs from the following sources:

• Local Event logs
• Evtx log files
• Microsoft Defender for Endpoint Advanced Hunting results

The cmdlet displays the logs in a GUI and allows the user to select the logs to be processed further.

The logs can be filtered based on many criteria using the available parameters.

The output of this cmdlet is a Supplemental Application Control (WDAC) policy. Based on the input parameters, it can be associated with a base policy or merged with an existing Base or Supplemental policy.

The cmdlet can be used for local and remote systems. You can utilize this cmdlet to create Application Control for Business policies from MDE Advanced Hunting and then deploy them using Microsoft Intune to your endpoints.

You can utilize this cmdlet to use the evtx log files you aggregated from your endpoints and create a WDAC policy from them.

This offers scalability and flexibility in managing your security policies.

Parameters

-PolicyToAddLogsTo

The policy to add the selected logs to, it can either be a base or supplemental policy.

Important

Only select one of the following three parameters: -PolicyToAddLogsTo, -BasePolicyFile, or -BasePolicyGUID.

Type:	FileInfo
Aliases:	AddLogs
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-BasePolicyFile

The base policy file to associate the supplemental policy with.

Important

Only select one of the following three parameters: -PolicyToAddLogsTo, -BasePolicyFile, or -BasePolicyGUID.

Type:	FileInfo
Aliases:	BaseFile
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-BasePolicyGUID

The GUID of the base policy to associate the supplemental policy with.

Important

Only select one of the following three parameters: -PolicyToAddLogsTo, -BasePolicyFile, or -BasePolicyGUID.

Type:	Guid
Aliases:	BaseGUID
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Source

The source of the logs. Supports validate set and auto-completion, press TAB key to view the list of the available options.

Type:	String
Aliases:	Src
Position:	Named
Accepted values:	LocalEventLogs, MDEAdvancedHunting, EVTXFiles
Default value:	LocalEventLogs
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-SuppPolicyName

The name of the supplemental policy to create

Type:	String
Aliases:	Name
Position:	Named
Default value:	The cmdlet will generate a proper name based on the selected source and time
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Level

The level determining rule generation can be one of the following: Auto, FilePublisher, Publisher, or Hash.

The fallback level is always Hash.

By default, which is the same as not using this parameter, the most secure levels are prioritized. If a log contains the requisite details for the FilePublisher level, it will be utilized. If not, the Publisher level will be attempted. Should this also fail, the Hash level will be employed.

Type:	String
Aliases:	Lvl
Position:	Named
Default value:	Auto
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-MDEAHLogs

The path(s) to use MDE AH CSV files.

Note

This is a dynamic parameter and will only be available if the Source parameter is set to MDEAdvancedHunting.

Important

Please read this article for complete information on how to use this feature.

Type:	FileInfo[]
Aliases:	MDELogs
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-EVTXLogs

The path(s) of EVTX files to use.

Note

This is a dynamic parameter and will only be available if the Source parameter is set to EVTXFiles.

Type:	FileInfo[]
Aliases:	Evtx
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-TimeSpan

The unit of time to use when filtering the logs by the time.

Type:	String
Aliases:	Duration
Position:	Named
Accepted values:	Minutes, Hours, Days
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-TimeSpanAgo

The number of the selected time unit to go back in time from the current time.

Note

This is a dynamic parameter and will only be available if the TimeSpan parameter is set.

Type:	String
Aliases:	Past
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-FilterByPolicyNames

The names of the policies to filter the logs by. Supports auto-completion, press TAB key to view the list of the deployed base policy names to choose from. It will not display the policies that are already selected on the command line.

You can manually enter the name of the policies that are no longer available on the system.

Type:	String[]
Aliases:	FilterNames
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-KernelModeOnly

If used, will filter the logs by including only the Kernel-Mode logs.

Type:	SwitchParameter
Aliases:	KMode
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-LogType

The type of logs to display.

Type:	String
Aliases:	LogKind
Position:	Named
Accepted values:	Audit, Blocked
Default value:	Audit
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-Deploy

If used, will deploy the policy on the system.

Type:	SwitchParameter
Aliases:	Up
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False

-ExtremeVisibility

If used, will display all the properties of the logs without any filtering.

Type:	SwitchParameter
Aliases:	XVis
Position:	Named
Default value:	None
Required:	False
Accept pipeline input:	False
Accept wildcard characters:	False