{"id":13598196,"url":"https://github.com/LearningKijo/MDEtester","last_synced_at":"2025-04-10T06:31:23.901Z","repository":{"id":214115061,"uuid":"735716715","full_name":"LearningKijo/MDEtester","owner":"LearningKijo","description":"MDE Tester is designed to help testing various features in Microsoft Defender for Endpoint.","archived":false,"fork":false,"pushed_at":"2024-03-04T02:46:33.000Z","size":60,"stargazers_count":184,"open_issues_count":1,"forks_count":21,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-08-02T17:32:51.760Z","etag":null,"topics":["defenderforendpoint","edr","powershell","testing"],"latest_commit_sha":null,"homepage":"","language":"PowerShell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/LearningKijo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2023-12-25T23:54:05.000Z","updated_at":"2024-08-02T07:51:22.000Z","dependencies_parsed_at":"2024-01-01T06:34:58.165Z","dependency_job_id":"6a182643-6934-4c91-ad43-2ed2ed35f735","html_url":"https://github.com/LearningKijo/MDEtester","commit_stats":{"total_commits":31,"total_committers":1,"mean_commits":31.0,"dds":0.0,"last_synced_commit":"21d635e0285ab97f89a83afa5714d7f2df2372a0"},"previous_names":["learningkijo/mdetester"],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LearningKijo%2FMDEtester","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LearningKijo%2FMDEtester/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LearningKijo%2FMDEtester/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/LearningKijo%2FMDEtester/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/LearningKijo","download_url":"https://codeload.github.com/LearningKijo/MDEtester/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223427590,"owners_count":17143319,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["defenderforendpoint","edr","powershell","testing"],"created_at":"2024-08-01T17:00:49.897Z","updated_at":"2024-11-06T22:31:44.240Z","avatar_url":"https://github.com/LearningKijo.png","language":"PowerShell","funding_links":[],"categories":["PowerShell"],"sub_categories":[],"readme":"# MDE Tester\n\nMDE Tester is designed to help testing various features in Microsoft Defender for Endpoint. \n\n|  PS script   | Testing features |\n|:-------------|:-----------------|\n|`MDEtesterTP.ps1` | 1. Microsoft Defender for Endpoint, Tamper Protection |\n|`MDEtesterWP.ps1` | 1. Microsoft Defender SmartScreen \u003cbr\u003e 2. Microsoft Defender Exploit Guard, Network Protection \u003cbr\u003e 3. Microsoft Defender for Endpoint, URL Indicators \u003cbr\u003e 4. Microsoft Defender for Endpoint, Web Content Filtering |\n\n## MDEtesterTP.ps1\n### Prerequisites\n-  `MDEtesterTP.ps1` helps confirm the status of Microsoft Defender for Endpoint, Tamper Protection. \n However, to test AV tampering in `MDEtesterTP.ps1`, enabling Tamper Protection is required.\n- Run  `MDEtesterTP.ps1` script as Administrator.\n\n### Usage\n\n```\nPS C:\\\u003e .\\MDEtesterTP.ps1 \n```\n\n### How it looks like\n![image](https://github.com/LearningKijo/MDEtester/assets/120234772/a1f663e0-09fe-4fd1-a409-d76cece7c1a1)\n\n## MDEtesterWP.ps1\n### Prerequisites\n\n`MDEtesterWP.ps1` assumes that the following items are installed, enabled and onboared.\n- Install Google Chrome \u0026 Microsoft Edge\n- Enable [Real-Time protection](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-microsoft-defender-antivirus-features?view=o365-worldwide), Microsoft Defender Antivirus\n- Enable [Microsoft Defender SmartScreen](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)\n- Enable [Microsoft Defender Exploit Guard, Network Protection](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/network-protection?view=o365-worldwide)\n- Onboard [Microsoft Defender for Endpoint](https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint?view=o365-worldwide) \n\n### Usage\n\n***Test 1***\n```\nPS C:\\\u003e .\\MDEtesterWP.ps1 \n```\n***Test 2***\n```\nPS C:\\\u003e .\\MDEtesterWP.ps1 -Path \u003cCSV File path\u003e\n```\n***Test 3***\n```\nPS C:\\\u003e .\\MDEtesterWP.ps1 -Category \u003ccategory\u003e\n```\n***Test 4***\n```\nPS C:\\\u003e .\\MDEtesterWP.ps1 -Path \u003cCSV File path\u003e -Category \u003ccategory\u003e\n```\n\n|    Features  | Test 1 | Test 2 | Test 3 | Test 4 |\n|:-----|--------|--------|-------|--------|\n|  Microsoft Defender SmartScreen  | 〇 | 〇 | 〇 | 〇 |\n|  Network Protection                       | 〇 | 〇 | 〇 | 〇 |\n|  MDE URL Indicators                       | × | 〇 | × | 〇 |\n|  MDE Web Content Filtering           | × | × | 〇 | 〇 |\n\n\u003e [!Important]\n\u003e **Signing**\n\u003e \n\u003e If your PowerShell execution policy is set to RemoteSigned, PowerShell will not run unsigned scripts downloaded from the internet. Therefore, please unblock the script using the cmdlet or through Properties. \u003cbr\u003e\n\u003e - [Running unsigned scripts using the RemoteSigned execution policy](https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7.4#running-unsigned-scripts-using-the-remotesigned-execution-policy)\n### Parameter\n```\n-Path \u003cString\u003e : This is an optional parameter. Please specify a CSV file path and it is used for testing MDE URL indicators.\n```\n\u003e [!Note]\n\u003e The CSV file column header must be ***'IndicatorValue'***. Here is [an example](https://github.com/LearningKijo/MDEtester/blob/main/Tools/Sample.csv).\n\n```\n-Category \u003cString\u003e :  This is an optional parameter. Please select a category you want to test and it is used for testing MDE WCF.\n\nHere are available categories :\nPS C:\\\u003e .\\MDEtesterWP.ps1 -Category AdultContent\nPS C:\\\u003e .\\MDEtesterWP.ps1 -Category HighBandwidth\nPS C:\\\u003e .\\MDEtesterWP.ps1 -Category LegalLiability\nPS C:\\\u003e .\\MDEtesterWP.ps1 -Category Leisure\n```\n\u003e [!Note] \n\u003e In this MDE Tester script, WEC will be tested against high-level categories such as 'AdultContent,' 'HighBandwidth,' 'LegalLiability,' and 'Leisure.' Please note that some specific categories might not be covered, and the 'Uncategorized' category is not included in this script.\n\n### LOG\nAfter you run `MDEtesterWP.ps1`, all logs will be created by the script and available following the path - `C:\\MDE-tester`.\n\n### How it looks like\n![image](https://github.com/LearningKijo/MDEtester/assets/120234772/34deb2dd-8a9a-48e4-a2eb-dd52cf8ee57c)\n\n#### Disclaimer\nThe views and opinions expressed herein are those of the author and do not necessarily reflect the views of company.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FLearningKijo%2FMDEtester","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FLearningKijo%2FMDEtester","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FLearningKijo%2FMDEtester/lists"}