#Requires -Version 5.1
<#  SilverMetal Enhanced - Windows | Domain E: Application control
    WDAC (App Control) AUDIT-first then enforce; Defender ASR at max; Defender
    on for detection but sample submission OFF (privacy); SmartScreen; CFA.
    Balanced posture = audit before enforce (don't brick the dev workflow).
    Spec: ../hardening-spec.md (E)   |   SCAFFOLD (M1).
#>
[CmdletBinding()] param()
Set-StrictMode -Version Latest; $ErrorActionPreference = 'Stop'
Write-Host '[E] Application control'

# --- Defender: detection on, but do NOT exfiltrate user files ---
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent 2          # 2 = never send samples
Set-MpPreference -PUAProtection Enabled
Set-MpPreference -EnableControlledFolderAccess Enabled

# --- ASR rules at max (Block) ---
$asr = @{
  'BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550'=1  # block executable content from email/webmail
  '9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2'=1  # block credential stealing from lsass
  'D4F940AB-401B-4EFC-AADC-AD5F3C50688A'=1  # block Office child processes
  '3B576869-A4EC-4529-8536-B80A7769E899'=1  # block Office executable content creation
  '5BEB7EFE-FD9A-4556-801D-275E5FFC04CC'=1  # block obfuscated scripts
  'D3E037E1-3EB8-44C8-A917-57927947596D'=1  # block JS/VBS launching downloaded content
  'B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4'=1  # block untrusted/unsigned from USB
}
foreach ($id in $asr.Keys) { Add-MpPreference -AttackSurfaceReductionRules_Ids $id -AttackSurfaceReductionRules_Actions $asr[$id] }

# --- WDAC: deploy base policy in AUDIT first ---
# TODO-M1: compile ..\wdac\silvermetal-base.xml -> .cip in AUDIT mode (option 3 'Audit Mode' set),
#          stage to C:\Windows\System32\CodeIntegrity\CiPolicies\Active, CiTool --refresh.
#          After a real-usage shakedown, regenerate from audit events and PROMOTE to enforce.
Write-Warning '   WDAC base policy authoring is M1 (audit) -> M2 (enforce). Not yet deployed.'

Write-Host '   [E] Defender+ASR applied; WDAC pending policy authoring.'
