Windows
Hardening

# ---------------------------------------------------------
# APEX OMEGA PROTOCOL - DEFENDER GOD_MODE (PARANOID SECURITY)
# Härtet Microsoft Defender, Firewall und Exploit Guard auf das absolute Maximum.
# ---------------------------------------------------------

# 1. INITIALISIERUNG
$ErrorActionPreference = "Stop"
$LogPrefix = "[OMEGA-FORTRESS]"

function Write-Log ($Message, $Color="Cyan") {
    Write-Host "$LogPrefix $Message" -ForegroundColor $Color
}

# Admin Check
$CurrentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if (-not $CurrentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Log "FATAL: ADMIN-RECHTE ERFORDERLICH." "Red"
    exit
}

Clear-Host
Write-Log "INITIALISIERE DEFENDER GOD_MODE..." "Magenta"

# ---------------------------------------------------------
# 2. HEURISTIK & CLOUD (ZERO TOLERANCE)
# ---------------------------------------------------------
Write-Log "KONFIGURIERE AGGRESSIVE HEURISTIK..." "Yellow"

# MAPS (Microsoft Advanced Protection Service) Beitritt erzwingen für schnellen Cloud-Abgleich
Set-MpPreference -MAPSReporting Advanced
Set-MpPreference -SubmitSamplesConsent SendSafeSamples

# Cloud Block Level: 6 = Zero Tolerance (Blockiert alles Unbekannte)
# 2 = High, 4 = HighPlus, 6 = ZeroTolerance
Set-MpPreference -CloudBlockLevel 6
Set-MpPreference -CloudExtendedTimeout 50

# Potentially Unwanted Applications (Adware, Cryptominer, Bundler)
Set-MpPreference -PUAProtection Enabled

# Network Protection (SmartScreen für ALLES, nicht nur Edge)
Set-MpPreference -EnableNetworkProtection Enabled

# Scans für Wechseldatenträger erzwingen
Set-MpPreference -DisableRemovableDriveScanning 0
Set-MpPreference -DisableArchiveScanning 0

# ---------------------------------------------------------
# 3. ATTACK SURFACE REDUCTION (THE COMPLETE KILL LIST)
# ---------------------------------------------------------
Write-Log "AKTIVIERE SÄMTLICHE ASR-REGELN (BLOCK MODE)..." "Red"

# Vollständige Liste der ASR GUIDs (Stand 2025)
$ASR_Rules = @{
    "Block abuse of exploited vulnerable signed drivers" = "56a863a9-875e-4185-98a7-b882c64b5ce5";
    "Block Adobe Reader from creating child processes" = "7674ce52-37eb-4751-a02f-8e00ca252d60";
    "Block all Office applications from creating child processes" = "d4f940ab-401b-4efc-aadc-ad5f3c50688a";
    "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" = "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2";
    "Block executable content from email client and webmail" = "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550";
    "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" = "01443614-9b74-4270-a5db-e0883af26276";
    "Block execution of potentially obfuscated scripts" = "5beb7efe-fd9a-4556-801d-275e5ffc04cc";
    "Block JavaScript or VBScript from launching downloaded executable content" = "d3e037e1-3eb8-44c8-a917-57927947596d";
    "Block Office applications from creating executable content" = "3b576869-a4ec-4529-8536-b80a7769e899";
    "Block Office applications from injecting code into other processes" = "75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84";
    "Block Office communication application from creating child processes" = "26190899-1602-49e8-8b27-eb1d0a1ce869";
    "Block persistence through WMI event subscription" = "e6db77e5-3dde-48c5-9d5b-c63729d70845";
    "Block process creations originating from PSExec and WMI commands" = "d1e49aac-8f56-4280-b9ba-993a6d77406c";
    "Block untrusted and unsigned processes that run from USB" = "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4";
    "Block Win32 API calls from Office macros" = "92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b";
    "Use advanced protection against ransomware" = "c1db55ab-c21a-4637-bb3f-a12568109d35"
}

foreach ($RuleName in $ASR_Rules.Keys) {
    $ID = $ASR_Rules[$RuleName]
    try {
        Add-MpPreference -AttackSurfaceReductionRules_Ids $ID -AttackSurfaceReductionRules_Actions Enabled -ErrorAction Stop
        Write-Log " >> ASR ACTIVE: $RuleName" "Green"
    } catch {
        Write-Log " >> ASR ERROR: $RuleName ($ID)" "DarkGray"
    }
}

# ---------------------------------------------------------
# 4. RANSOMWARE SCHUTZ (CONTROLLED FOLDER ACCESS)
# ---------------------------------------------------------
Write-Log "AKTIVIERE SCHREIB-SPERRE FÜR DOKUMENTE..." "Yellow"

# Schützt User-Ordner vor Änderungen durch nicht-whitelisted Apps
Set-MpPreference -EnableControlledFolderAccess Enabled

# ---------------------------------------------------------
# 5. FIREWALL HARDENING
# ---------------------------------------------------------
Write-Log "HÄRTE WINDOWS FIREWALL..." "Cyan"

$Profiles = @("Domain", "Public", "Private")

foreach ($Profile in $Profiles) {
    # Blockiert eingehende Verbindungen, die nicht explizit erlaubt sind
    Set-NetFirewallProfile -Name $Profile -Enabled True -DefaultInboundAction Block
    
    # Logging aktivieren (Dropped Packets sehen)
    Set-NetFirewallProfile -Name $Profile -LogFileName "$env:systemroot\system32\LogFiles\Firewall\pfirewall_$Profile.log" -LogMaxSizeKilobytes 4096 -LogBlocked True -LogAllowed False
}

Write-Log "------------------------------------------------" "Cyan"
Write-Log "APEX OMEGA PROTOCOL: FORTRESS MODE AKTIV." "Green"
Write-Log "HINWEIS: Unbekannte .exe Dateien werden nun aggressiv blockiert." "Yellow"
Write-Log "HINWEIS: 'Controlled Folder Access' muss ggf. manuell für Spiele erlaubt werden." "Yellow"
Write-Log "------------------------------------------------" "Cyan"

<#
.SYNOPSIS
    APEX OMEGA PROTOCOL - GATEKEEPER (TEMPORARY ACCESS)
    Öffnet temporär die Sicherheits-Schleusen für Installationen/Updates
    und verriegelt das System danach wieder hermetisch.
#>

$ErrorActionPreference = "Stop"

# Farben für Output
$ColorGreen = "Green"
$ColorRed = "Red"
$ColorYellow = "Yellow"
$ColorCyan = "Cyan"

function Print-Banner {
    Clear-Host
    Write-Host "==============================================" -ForegroundColor $ColorCyan
    Write-Host "      APEX OMEGA: GATEKEEPER INTERFACE        " -ForegroundColor $ColorCyan
    Write-Host "==============================================" -ForegroundColor $ColorCyan
    Write-Host ""
}

# 1. Admin Check
$CurrentPrincipal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if (-not $CurrentPrincipal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
    Write-Host "FATAL: KEINE ADMIN-RECHTE." -ForegroundColor $ColorRed
    Write-Host "Bitte Rechtsklick -> 'Mit PowerShell ausführen'" -ForegroundColor $ColorRed
    Start-Sleep -Seconds 5
    exit
}

Print-Banner

# ---------------------------------------------------------
# PHASE 1: SCHILDE SENKEN
# ---------------------------------------------------------
Write-Host "[STATUS] SYSTEM WIRD ENRIEGELT..." -ForegroundColor $ColorYellow

try {
    # Cloud Level normalisieren (Standard Windows Level)
    Set-MpPreference -CloudBlockLevel 0
    Write-Host " >> CLOUD SCANNER:      NORMALISIERT (Level 0)" -ForegroundColor $ColorYellow

    # Ransomware Schutz temporär aus
    Set-MpPreference -EnableControlledFolderAccess Disabled
    Write-Host " >> ORDNER-SCHUTZ:      DEAKTIVIERT (Schreiben erlaubt)" -ForegroundColor $ColorYellow

    # Netzwerk Schutz auf Audit (Beobachten statt Blocken)
    Set-MpPreference -EnableNetworkProtection AuditMode
    Write-Host " >> NETZWERK-GUARD:     AUDIT MODE" -ForegroundColor $ColorYellow
    
    # PUA auf Audit
    Set-MpPreference -PUAProtection AuditMode
    Write-Host " >> PUA-ERKENNUNG:      AUDIT MODE" -ForegroundColor $ColorYellow

} catch {
    Write-Host "FEHLER BEIM SENKEN DER SCHILDE: $($_.Exception.Message)" -ForegroundColor $ColorRed
    Read-Host "Drücke Enter zum Beenden..."
    exit
}

# ---------------------------------------------------------
# PHASE 2: WARTE-SCHLEIFE
# ---------------------------------------------------------
Write-Host ""
Write-Host "==============================================" -ForegroundColor $ColorRed
Write-Host "   WARNUNG: SCHILDE SIND UNTEN (DEFCON 5)     " -ForegroundColor $ColorRed
Write-Host "==============================================" -ForegroundColor $ColorRed
Write-Host ""
Write-Host "1. Führe jetzt deine Installation / dein Spiel aus." -ForegroundColor $ColorGreen
Write-Host "2. Wenn alles fertig ist, komme hierher zurück." -ForegroundColor $ColorGreen
Write-Host ""

$null = Read-Host "Drücke [ENTER] um die Schilde wieder hochzufahren (LOCKDOWN)"

# ---------------------------------------------------------
# PHASE 3: RE-INITIALISIERUNG (FORTRESS MODE)
# ---------------------------------------------------------
Print-Banner
Write-Host "[STATUS] RE-INITIALISIERUNG DER SICHERHEITSPROTOKOLLE..." -ForegroundColor $ColorCyan

try {
    # Cloud Level auf PARANOID
    Set-MpPreference -CloudBlockLevel 6
    Write-Host " >> CLOUD SCANNER:      ZERO TOLERANCE (Level 6)" -ForegroundColor $ColorGreen

    # Ransomware Schutz AN
    Set-MpPreference -EnableControlledFolderAccess Enabled
    Write-Host " >> ORDNER-SCHUTZ:      AKTIV (BLOCK MODE)" -ForegroundColor $ColorGreen

    # Netzwerk Schutz AN
    Set-MpPreference -EnableNetworkProtection Enabled
    Write-Host " >> NETZWERK-GUARD:     AKTIV (BLOCK MODE)" -ForegroundColor $ColorGreen

    # PUA AN
    Set-MpPreference -PUAProtection Enabled
    Write-Host " >> PUA-ERKENNUNG:      AKTIV (BLOCK MODE)" -ForegroundColor $ColorGreen

    # Kurzer Check der ASR Regeln (Sicherstellen, dass sie aktiv bleiben)
    # Wir setzen hier exemplarisch eine kritische Regel neu, um den Status zu forcieren
    Add-MpPreference -AttackSurfaceReductionRules_Ids "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550" -AttackSurfaceReductionRules_Actions Enabled
    Write-Host " >> ASR REGELWERK:      VERIFIZIERT" -ForegroundColor $ColorGreen

} catch {
    Write-Host "FATALER FEHLER BEIM RE-AKTIVIEREN: $($_.Exception.Message)" -ForegroundColor $ColorRed
    Write-Host "BITTE SYSTEM NEUSTARTEN UM STANDARD WIEDERHERZUSTELLEN." -ForegroundColor $ColorRed
    Read-Host "Enter..."
    exit
}

Write-Host ""
Write-Host "==============================================" -ForegroundColor $ColorGreen
Write-Host "      SYSTEMSTATUS: FORTRESS (SECURE)         " -ForegroundColor $ColorGreen
Write-Host "==============================================" -ForegroundColor $ColorGreen
Start-Sleep -Seconds 2