Skip to content

Instantly share code, notes, and snippets.

@Colby-PDQ
Created February 11, 2020 18:02
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save Colby-PDQ/6ddcf5680e5ca3f22aaf1b6f98e97cb9 to your computer and use it in GitHub Desktop.
Save Colby-PDQ/6ddcf5680e5ca3f22aaf1b6f98e97cb9 to your computer and use it in GitHub Desktop.
A PDQ Inventory Tool that creates a firewall rule to block ICMPv4 to the target you specify.
<?xml version="1.0" encoding="utf-8"?>
<AdminArsenal.Export Code="PDQInventory" Name="PDQ Inventory" Version="18.3.32.0" MinimumVersion="15.0">
<CustomTool>
<CredentialsId value="null" />
<RunAs>Admin</RunAs>
<ScanAfter>DoNotScan</ScanAfter>
<ScanProfileId value="null" />
<SuccessCodesText>0</SuccessCodesText>
<Timeout>00:00:30</Timeout>
<WakeOnLan value="false" />
<CustomToolType>Local</CustomToolType>
<CommandLine>"Creating a firewall rule to block ICMPv4 to $(Computer:TARGET) - $(Computer:TARGETIPADDRESS)"
""
$null = netsh advfirewall firewall add rule name="Block $(Computer:TARGET)" dir=out action=block profile=any remoteip=$(Computer:TARGETIPADDRESS) protocol=icmpv4
"Run a manual Heartbeat (CTRL+H) against $(Computer:TARGET). It should now show as Offline."
""
Read-Host "Press ENTER in this window once $(Computer:TARGET) is Offline, wait a few seconds, then run another Heartbeat"
$null = netsh advfirewall firewall delete rule name="Block $(Computer:TARGET)"</CommandLine>
<DefaultIconKey></DefaultIconKey>
<LibraryToolId value="null" />
<Modified value="null" />
<ShellOpenMode>CloseShell</ShellOpenMode>
<Mode>PowerShell</Mode>
<Description></Description>
<IconKey>Icon-PowerShell</IconKey>
<KeyGesture></KeyGesture>
<Title>Trigger Heartbeat Schedules</Title>
<TypeName>CustomTool</TypeName>
</CustomTool>
</AdminArsenal.Export>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment