search

scipag / HardeningKitty

HardeningKitty - Checks and hardens your Windows configuration
MIT License
1.3k stars 161 forks source link

Filters seem to be Ignored in Mode HailMary #60

Open PauleTR opened 4 days ago

PauleTR commented 4 days ago

Hi team, thank you so much for this great software and all the work put into the lists!

I have been trying to use the tool to set some individual configurations without editing the csv lists. Instead, I've tried setting filters on the IDs I'm interested in, This works well for audit and backup: Invoke-HardeningKitty -Filter { 1900,1911 -contains $_.ID } -FileFindingList ..\ASR.csv -Mode Audit Invoke-HardeningKitty -Filter { 1900,1911 -contains $_.ID } -FileFindingList ..\ASR.csv -Mode Config -Backup -BackupFile ..\ASR_Backup_2.csv

When using the same filter with HailMary, the filter was ignored and every single line of the file was configured with the recommended value. I did this on a test system with just the asr rules in my list file, so no great harm was done. But I was surprised and the csv backup list was incomplete because the filters worked fine there ... Is this a bug or did I do something wrong?

Version used: 0.9.2-1690255284

Many thanks and best regards,

PauleTR

0x6d69636b commented 4 days ago

Hi PauleTR,

For now, the filter function is only supported in Audit and Config mode. As the HailMary mode is a delicate matter, I suggest you create your own file and remove all the lines you want to filter.

I updated the documentation in the dev repo: https://github.com/0x6d69636b/windows_hardening/commit/ead6933714889d579f5ec71be3cd898fa0ef4590

All the best