Get-BlockedPowershellHashInCIPolicy.ps1

# Based on a hint by @tiraniddo in chat today on Matt's Twitch Stream - https://www.twitch.tv/mattifestation
# Context: https://github.com/MicrosoftDocs/windows-itpro-docs/blob/public/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md

# What does the script do?:
# Get a list of blocked filenames from the hashes in Microsoft recommended block rules.

# Result
# Some strange filenames from hashes in VT output, for e.g.169339.ps1
# Some hashes do not exist in VT.

# Get your API Key
$apiKey = '6f0c5de018542'

# Source of XML - https://raw.githubusercontent.com/MicrosoftDocs/windows-itpro-docs/public/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
[xml]$xml = get-content .\BlockedPSHash.xml
$PSBlocks = $xml.SiPolicy.FileRules.Deny | where {$_.FriendlyName -match "Powershell"}

$headers = @{
    'x-apikey' = $APIKey    
}
 
1..$PSBlocks.Length  | foreach {
    #Initialize Vars
    $props,$output,$res = $null
    
    $hash = $PSBlocks[$_].Hash
    $res= Invoke-RestMethod -Method 'GET' -Uri "https://www.virustotal.com/api/v3/files/$hash" -Headers $headers 
    
    $props = [ordered]@{
        Hash = $hash
        MeaningfulName = $res.data.attributes.meaningful_name
        FileNames = $res.data.attributes.names
        Generator= $res.data.attributes.trusted_verdict.generator
        Organization= $res.data.attributes.trusted_verdict.organization
        Verdict = $res.data.attributes.trusted_verdict.verdict
    }
    $output = New-Object -TypeName psobject -Property $props
    $output       
}

Output.csv