Transport Rules Zonder Sender Whitelisting

<# .SYNOPSIS Transport Rules No Whitelist .DESCRIPTION Checks for transport rules that bypass spam filters (security risk) .NOTES NL Baseline v2.0 #> #Requires -Version 5.1 #Requires -Modules ExchangeOnlineManagement [CmdletBinding()] param([switch]$Monitoring) $ErrorActionPreference = 'Stop' Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Transport Rules No Whitelist" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan function Invoke-Monitoring { try { Connect-ExchangeOnline -ShowBanner:$false -ErrorAction Stop $rules = Get-TransportRule $result = @{ total = $rules.Count; whitelistRules = 0; flaggedRules = @() } foreach ($rule in $rules) { $hasWhitelist = $false # Check for SCL bypass (-1 = bypass spam filtering) if ($rule.SetSCL -eq -1) { $hasWhitelist = $true } # Check for rules that allow messages without filtering if ($rule.DeleteMessage -eq $false -and $rule.Quarantine -eq $false -and ($rule.FromAddressContainsWords -or $rule.FromAddressMatchesPatterns)) { $hasWhitelist = $true } if ($hasWhitelist) { $result.whitelistRules++ $result.flaggedRules += $rule.Name Write-Host " ⚠️ WHITELIST RULE: $($rule.Name)" -ForegroundColor Red Write-Host " Priority: $($rule.Priority) | SCL: $($rule.SetSCL)" -ForegroundColor Gray } } Write-Host "`n Summary:" -ForegroundColor Cyan Write-Host " Total Rules: $($result.total)" -ForegroundColor White Write-Host " Whitelist Rules: $($result.whitelistRules)" -ForegroundColor $( if ($result.whitelistRules -eq 0) { 'Green' }else { 'Red' } ) Write-Host "`n Security Risk:" -ForegroundColor Cyan Write-Host " Whitelist rules bypass spam/malware filters" -ForegroundColor Gray Write-Host " Attackers can exploit these rules" -ForegroundColor Gray Write-Host " Recommendation: Remove or review carefully" -ForegroundColor Gray if ($result.whitelistRules -eq 0) { Write-Host "`n[OK] COMPLIANT - No whitelist rules" -ForegroundColor Green exit 0 } else { Write-Host "`n[FAIL] NON-COMPLIANT - Whitelist rules found!" -ForegroundColor Red Write-Host "Manual review required - remove or justify each rule" -ForegroundColor Yellow exit 1 } } catch { Write-Host "ERROR: $_" -ForegroundColor Red exit 2 } } try { if ($Monitoring) { Invoke-Monitoring } else { Write-Host "Use: -Monitoring (Manual review required)" -ForegroundColor Yellow } } catch { throw } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan } function Invoke-Remediation { <# .SYNOPSIS Herstelt de configuratie naar de gewenste staat .DESCRIPTION Dit is een monitoring-only control, remediation delegeert naar monitoring #> [CmdletBinding()] param() Write-Host "[INFO] Dit is een monitoring-only control" -ForegroundColor Yellow Write-Host "[INFO] Running monitoring check..." -ForegroundColor Cyan Invoke-Monitoring }