nafai

# Joel Roth 2023

[CmdletBinding()]Param(
    [string]$UpdateFile = "$env:SystemRoot\System32\SecureBootUpdates\SKUSiPolicy.p7b",
    [string]$UpdateHash = "8870483E0E833965A53F422494F1614F79286851"
    )
    
# Validate update file's hash against the expected one
Try
{

nafai

[CmdletBinding()]Param(
    [Parameter(ParameterSetName = 'Filename')]
    [string]$Filename,
    [Parameter(ParameterSetName = 'Base64')]
    [string]$Base64
    )
    
    
if (-NOT ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator"))
{

nafai

<ViewerConfig>
    <QueryConfig>
        <QueryParams>
            <UserQuery />
        </QueryParams>
        <QueryNode>
            <Name LanguageNeutralValue="File integrity monitoring">File integrity monitoring</Name>
            <QueryList>
                <Query Id="0" Path="Security">
                    <Select Path="Security">*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and (EventID=4656)]][EventData[Data[@Name='ObjectType']='File']][EventData[band(Data[@Name='AccessMask'],2)] or EventData[band(Data[@Name='AccessMask'],4)]]</Select>