Windows Host Security Configuration Reporter

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(349457);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/06");

  script_name(english:"Windows Host Security Configuration Reporter");
  script_set_attribute(attribute:"synopsis", value:
"Reports Windows host security configuration settings as internal host tags.");
  script_set_attribute(attribute:"description", value:
"This plugin aggregates Windows host security configuration settings collected by individual detection plugins and
reports the result as a structured internal host tag. The structured data object is reported even when only a subset of
the source plugins ran.");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/09/23");
  script_set_attribute(attribute:"plugin_type", value:"summary");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_attribute(attribute:"always_run", value:TRUE);
  script_end_attributes();

  script_category(ACT_END);
  script_family(english:"General");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_require_keys("trigger/host_security_configuration_reporter");

  exit(0);
}

include('debug.inc');
include('structured_data_host_security_configuration.inc');

# the KB key 'trigger/host_security_configuration_reporter' is used within script_require_keys to manage when this plugin runs.
# listing the other KB keys produced by the source plugins in script_require_ports won't work reliably in all cases,
# as the value of 0 is handled the same as not present.

# setting boolean values explicitly to lowercase true / false throughout the plugin is required for the SD object serialisation
# to work as intended.

# plugin 159929

var lsa_run_as_ppl = get_kb_item('plugins/159929/RunAsPPL');
if (!isnull(lsa_run_as_ppl))
{
  var lsa_status_map = {1: 'ENABLED_WITH_UEFI_LOCK', 2: 'ENABLED'};
  var lsa_status = lsa_status_map[lsa_run_as_ppl];
  if (isnull(lsa_status)) lsa_status = 'NOT_CONFIGURED';

  structured_data_host_security_configuration.set('lsa_protection', lsa_status);
}

# plugin 159817, from System\CurrentControlSet\Control\DeviceGuard\EnableVirtualizationBasedSecurity

var cg_vbs = get_kb_item('plugins/159817/EnableVirtualizationBasedSecurity');
var cg_vbs_status = NULL;
if (!isnull(cg_vbs))
{
  if (cg_vbs == 1) cg_vbs_status = true;
  else cg_vbs_status = false;
}

if (!isnull(cg_vbs_status))
{
  var cg = { 'vbs_status' : cg_vbs_status };

  # plugin 159817, from System\CurrentControlSet\Control\LSA\LsaCfgFlags

  var cg_lsa_flags = get_kb_item('plugins/159817/LsaCfgFlags');
  if (!isnull(cg_lsa_flags))
  {
    if (cg_lsa_flags == 1 || cg_lsa_flags == 2) cg.lsa_cfg_flags.enabled = true;
    else cg.lsa_cfg_flags.enabled = false;

    if (cg_lsa_flags == 1) cg.lsa_cfg_flags.uefi_lock = true;
    else cg.lsa_cfg_flags.uefi_lock = false;
  }

  # plugin 159817, from System\CurrentControlSet\Control\DeviceGuard\RequirePlatformSecurityFeatures

  var cg_psf = get_kb_item('plugins/159817/RequirePlatformSecurityFeatures');
  if (!isnull(cg_psf))
  {
    if (cg_psf == 1 || cg_psf == 3) cg.require_platform_security_features.secure_boot = true;
    else cg.require_platform_security_features.secure_boot = false;

    if (cg_psf == 3) cg.require_platform_security_features.dma_protection = true;
    else cg.require_platform_security_features.dma_protection = false;
  }

  # overall cg status

  # this matches the logic in credential_guard_status.nasl
  var cg_status = 0;
  if (cg_vbs_status) cg_status++;
  if (cg.lsa_cfg_flags.enabled) cg_status++;
  if (cg.require_platform_security_features.secure_boot) cg_status++;
  
  if (cg_status == 3) cg_status = 'ENABLED';
  else if (cg_status > 0) cg_status = 'PARTIALLY_ENABLED';
  else cg_status = 'DISABLED';

  cg.status = cg_status;

  structured_data_host_security_configuration.set('credential_guard', cg);
}

# plugin 162174

var always_install_elevated_hklm = get_kb_item('plugins/162174/hklm');
var always_install_elevated_hku = get_kb_item('plugins/162174/hku');
if (!isnull(always_install_elevated_hklm) && !isnull(always_install_elevated_hku))
{
  # HKLM
  var machine_policy_enabled = false;
  if (always_install_elevated_hklm == 1) machine_policy_enabled = true;

  # HKU
  var user_policy_enabled = false;
  if (always_install_elevated_hku == 1) user_policy_enabled = true;

  # aggregation
  var any_user_effective = false;
  if (machine_policy_enabled && user_policy_enabled) any_user_effective = true;

  var always_install_elevated = {};
  always_install_elevated.machine_policy_enabled = machine_policy_enabled;
  always_install_elevated.user_policy_enabled = user_policy_enabled;
  always_install_elevated.any_user_effective = any_user_effective;
    
  structured_data_host_security_configuration.set('always_install_elevated', always_install_elevated);
}

var script_execution = {};

# plugin 92367

var ps_native = get_kb_item('plugins/92367/native');
var ps_wow = get_kb_item('plugins/92367/wow6432node');

# schema enforcement in the unlikely case we got invalid input
var ps_allowed = {'UNRESTRICTED': 1, 'BYPASS': 1, 'ALLSIGNED': 1, 'REMOTESIGNED': 1, 'RESTRICTED': 1, 'UNDEFINED': 1};

if (!isnull(ps_native) && ps_allowed[toupper(ps_native)])
  script_execution.powershell_policy.native = toupper(ps_native);
if (!isnull(ps_wow) && ps_allowed[toupper(ps_wow)])
  script_execution.powershell_policy.wow6432node = toupper(ps_wow);

# plugin 164690

var disable_cmd = get_kb_item('plugins/164690/DisableCMD');
if (!isnull(disable_cmd))
{
  if (disable_cmd == 1) disable_cmd = 'CMD_AND_SCRIPTS_DISABLED';
  else if (disable_cmd == 2) disable_cmd = 'CMD_DISABLED';
  else disable_cmd = 'NOT_RESTRICTED';

  script_execution.cmd_restricted = disable_cmd;
}

if (!empty_or_null(keys(script_execution)))
{
  structured_data_host_security_configuration.set("script_execution", script_execution);
}

# plugin 83265

var laps_installed = get_kb_item('plugins/83265/laps_installed');
if (!isnull(laps_installed))
{
  if (laps_installed == 1) laps_installed = true;
  else laps_installed = false;

  structured_data_host_security_configuration.set('laps_installed', laps_installed);
}

# plugin 57608

var smb_signing_required = get_kb_item('plugins/57608/signing_required');
if (!isnull(smb_signing_required))
{
  if (smb_signing_required == 1) smb_signing_required = true;
  else smb_signing_required = false;

  var smb = {
    server: {
      signing_required: smb_signing_required
    }
  };

  structured_data_host_security_configuration.set('smb', smb);
}

# only emit the tag if any of the source plugins ran
if (max_index(keys(structured_data_host_security_configuration.data)) > 0)
  structured_data_host_security_configuration.report_internal();

var FLATLINE_TEST = !isnull(get_kb_item("flatline/TEST"));
if (FLATLINE_TEST)
{
  dbg::enable();
  dbg::set_log_level(2);

  var sd_data = structured_data_host_security_configuration.data;
  var output = strcat(
    'lsa_protection: ', string(sd_data["lsa_protection"]), '.\n',
    'credential_guard.status: ', string(sd_data["credential_guard"]["status"]), '.\n',
    'credential_guard.vbs_status: ', string(sd_data["credential_guard"]["vbs_status"]), '.\n',
    'credential_guard.lsa_cfg_flags.enabled: ', string(sd_data["credential_guard"]["lsa_cfg_flags"]["enabled"]), '.\n',
    'credential_guard.lsa_cfg_flags.uefi_lock: ', string(sd_data["credential_guard"]["lsa_cfg_flags"]["uefi_lock"]), '.\n',
    'credential_guard.require_platform_security_features.secure_boot: ', string(sd_data["credential_guard"]["require_platform_security_features"]["secure_boot"]), '.\n',
    'credential_guard.require_platform_security_features.dma_protection: ', string(sd_data["credential_guard"]["require_platform_security_features"]["dma_protection"]), '.\n',
    'always_install_elevated.machine_policy_enabled: ', string(sd_data["always_install_elevated"]["machine_policy_enabled"]), '.\n',
    'always_install_elevated.user_policy_enabled: ', string(sd_data["always_install_elevated"]["user_policy_enabled"]), '.\n',
    'always_install_elevated.any_user_effective: ', string(sd_data["always_install_elevated"]["any_user_effective"]), '.\n',
    'script_execution.powershell_policy.native: ', string(sd_data["script_execution"]["powershell_policy"]["native"]), '.\n',
    'script_execution.powershell_policy.wow6432node: ', string(sd_data["script_execution"]["powershell_policy"]["wow6432node"]), '.\n',
    'script_execution.cmd_restricted: ', string(sd_data["script_execution"]["cmd_restricted"]), '.\n',
    'laps_installed: ', string(sd_data["laps_installed"]), '.\n',
    'smb.server.signing_required: ', string(sd_data["smb"]["server"]["signing_required"]), '.\n'
  );

  dbg::detailed_log(lvl:1, src:SCRIPT_NAME, msg:output);
}

exit(0, "This plugin does not produce output.");