PowerPoint: Scan Encrypted Macros For VBA Signatures

<# .SYNOPSIS Dwingt scanning van gecodeerde macros in PowerPoint Open XML presentaties .DESCRIPTION Dit script implementeert CIS control O365-PT-000005 voor het scannen van gecodeerde macros in PowerPoint Open XML presentaties in Microsoft PowerPoint. Dit beschermt tegen verborgen schadelijke macros in gecodeerde bestanden. .REQUIREMENTS - PowerShell 5.1 of hoger - Lokale administrator rechten voor registry wijzigingen - Microsoft PowerPoint geïnstalleerd .PARAMETER Monitoring Controleert de huidige compliance status .PARAMETER Remediation Past de aanbevolen configuratie toe .PARAMETER Revert Herstelt de originele configuratie .PARAMETER WhatIf Toont wat er zou gebeuren zonder wijzigingen door te voeren .EXAMPLE .\scan-encrypted-macros.ps1 -Monitoring Controleert of gecodeerde macro scanning is ingeschakeld .EXAMPLE .\scan-encrypted-macros.ps1 -Remediation Schakelt gecodeerde macro scanning in .NOTES Registry pad: HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security Waarden: ScanEncryptedMacros = 1, VBAWarnings = 1 CIS Control: O365-PT-000005 DISA STIG: Microsoft Office 365 ProPlus v3r3 #> #Requires -Version 5.1 param( [switch]$Monitoring, [switch]$Remediation, [switch]$Revert, [switch]$WhatIf ) # Globale variabelen $RegistryPath = "HKCU:\Software\Policies\Microsoft\Office\16.0\PowerPoint\Security" $ValueName1 = "ScanEncryptedMacros" $ValueName2 = "VBAWarnings" $ExpectedValue = 1 $ControlID = "O365-PT-000005" function Test-Compliance { try { if (-not (Test-Path $RegistryPath)) { return $false } $v1 = Get-ItemProperty -Path $RegistryPath -Name $ValueName1 -ErrorAction SilentlyContinue $v2 = Get-ItemProperty -Path $RegistryPath -Name $ValueName2 -ErrorAction SilentlyContinue return (($v1 -and $v1.$ValueName1 -eq $ExpectedValue) -or ($v2 -and $v2.$ValueName2 -ge $ExpectedValue)) } catch { return $false } } function Invoke-Monitoring { Write-Host "Monitoring ${ControlID}: Gecodeerde macro scanning inschakelen" -ForegroundColor Green try { if (-not (Test-Path $RegistryPath)) { Write-Host "✗ Registry pad bestaat niet: $RegistryPath" -ForegroundColor Red return $false } $v1 = Get-ItemProperty -Path $RegistryPath -Name $ValueName1 -ErrorAction SilentlyContinue $v2 = Get-ItemProperty -Path $RegistryPath -Name $ValueName2 -ErrorAction SilentlyContinue $scanEnabled = (($v1 -and $v1.$ValueName1 -eq $ExpectedValue) -or ($v2 -and $v2.$ValueName2 -ge $ExpectedValue)) if ($scanEnabled) { Write-Host "✓ Control compliant: Gecodeerde macro scanning is ingeschakeld" -ForegroundColor Green return $true } else { Write-Host "✗ Control non-compliant: Gecodeerde macro scanning is uitgeschakeld" -ForegroundColor Red return $false } } catch { Write-Host "✗ Fout bij controleren registry instellingen: $($_.Exception.Message)" -ForegroundColor Red return $false } } function Invoke-Remediation { Write-Host "Remediating ${ControlID}: Gecodeerde macro scanning inschakelen" -ForegroundColor Yellow try { if ($WhatIf) { Write-Host "WhatIf: Zou registry waarden instellen: ${ValueName1} = $ExpectedValue, ${ValueName2} = $ExpectedValue" -ForegroundColor Cyan return $true } if (-not (Test-Path $RegistryPath)) { Write-Host "Registry pad aanmaken: $RegistryPath" -ForegroundColor Yellow New-Item -Path $RegistryPath -Force | Out-Null } Set-ItemProperty -Path $RegistryPath -Name $ValueName1 -Value $ExpectedValue -Type DWord -Force Set-ItemProperty -Path $RegistryPath -Name $ValueName2 -Value $ExpectedValue -Type DWord -Force Write-Host "✓ Registry waarden succesvol ingesteld" -ForegroundColor Green Start-Sleep -Seconds 1 return Invoke-Monitoring } catch { Write-Host "✗ Fout bij configureren registry instellingen: $($_.Exception.Message)" -ForegroundColor Red return $false } } function Invoke-Revert { Write-Host "Reverting ${ControlID}: Gecodeerde macro scanning herstellen" -ForegroundColor Yellow try { if ($WhatIf) { Write-Host "WhatIf: Zou registry waarden verwijderen: ${ValueName1}, ${ValueName2}" -ForegroundColor Cyan return $true } if (Test-Path $RegistryPath) { Remove-ItemProperty -Path $RegistryPath -Name $ValueName1 -ErrorAction SilentlyContinue Remove-ItemProperty -Path $RegistryPath -Name $ValueName2 -ErrorAction SilentlyContinue Write-Host "✓ Registry waarden verwijderd" -ForegroundColor Green } return $true } catch { Write-Host "✗ Fout bij herstellen registry instellingen: $($_.Exception.Message)" -ForegroundColor Red return $false } } # Hoofd uitvoering try { if ($Monitoring) { $result = Invoke-Monitoring exit $(if ($result) { 0 } else { 1 }) } elseif ($Remediation) { $result = Invoke-Remediation exit $(if ($result) { 0 } else { 1 }) } elseif ($Revert) { $result = Invoke-Revert exit $(if ($result) { 0 } else { 1 }) } else { Write-Host "Gebruik: .\trust-vba-project-access-disabled.ps1 [-Monitoring] [-Remediation] [-Revert] [-WhatIf]" -ForegroundColor Yellow Write-Host " -Monitoring: Controleer huidige compliance status" -ForegroundColor White Write-Host " -Remediation: Pas aanbevolen configuratie toe" -ForegroundColor White Write-Host " -Revert: Herstel originele configuratie" -ForegroundColor White Write-Host " -WhatIf: Toon wat er zou gebeuren" -ForegroundColor White Write-Host "" Write-Host "Handmatige configuratie:" -ForegroundColor Cyan Write-Host "Group Policy: User Configuration > Administrative Templates > Microsoft PowerPoint 2016" -ForegroundColor White Write-Host "> PowerPoint Options > Security > Trust Center > Macro Settings" -ForegroundColor White Write-Host "> Scan encrypted macros in PowerPoint Open XML presentations: Enabled: Scan encrypted macros" -ForegroundColor White } } catch { Write-Host "✗ Onverwachte fout: $($_.Exception.Message)" -ForegroundColor Red exit 1 }