v2.2.2: Performance fix for firewall snapshot (60-120s to 2-5s) + version alignment

This commit is contained in:
NexusOne23 2025-12-22 06:46:53 +01:00
parent 73b7e7c68e
commit 877e01df37
65 changed files with 183 additions and 137 deletions

View file

@ -1,6 +1,6 @@
@{
RootModule = 'ASR.psm1'
ModuleVersion = '2.2.1'
ModuleVersion = '2.2.2'
GUID = 'b2c3d4e5-f6a7-8901-bcde-f23456789012'
Author = 'NexusOne23'
CompanyName = 'Open Source Project'
@ -25,7 +25,7 @@
LicenseUri = ''
ProjectUri = ''
ReleaseNotes = @"
v2.2.1 - Production Release
v2.2.2 - Production Release
- All 19 ASR rules implementation
- Hybrid approach: Registry backup + Set-MpPreference application
- SCCM/Configuration Manager detection

View file

@ -11,7 +11,7 @@
.NOTES
Author: NexusOne23
Version: 2.2.1
Version: 2.2.2
Requires: PowerShell 5.1+, Administrator privileges, Windows Defender
#>

View file

@ -2,7 +2,7 @@
# Module manifest for AdvancedSecurity
# Version
ModuleVersion = '2.2.1'
ModuleVersion = '2.2.2'
# Unique ID
GUID = 'e7f5a3d2-8c9b-4f1e-a6d3-9b2c8f4e5a1d'
@ -48,7 +48,7 @@
LicenseUri = ''
ProjectUri = ''
ReleaseNotes = @'
v2.2.1 (2025-12-08)
v2.2.2 (2025-12-08)
- Production release of AdvancedSecurity module
- 49 advanced hardening settings implemented (was 36)
- NEW: Wireless Display (Miracast) security hardening

View file

@ -1,5 +1,5 @@
# AdvancedSecurity Module Loader
# Version: 2.2.1
# Version: 2.2.2
# Description: Advanced Security Hardening - Beyond Microsoft Security Baseline
# Get module path

View file

@ -2,7 +2,7 @@
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "Administrative Shares Configuration",
"description": "Configuration for disabling administrative shares (C$, ADMIN$, etc.) to prevent lateral movement",
"version": "2.2.1",
"version": "2.2.2",
"Administrative_Shares": {
"description": "Disable automatic creation and remove existing administrative shares",

View file

@ -2,7 +2,7 @@
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "Credential Protection Configuration",
"description": "Configuration for credential hardening including WDigest protection",
"version": "2.2.1",
"version": "2.2.2",
"WDigest_Protection": {
"description": "Prevent WDigest from storing plaintext passwords in LSASS memory",

View file

@ -2,7 +2,7 @@
"$schema": "http://json-schema.org/draft-07/schema#",
"title": "RDP Hardening Configuration",
"description": "Configuration for RDP (Remote Desktop Protocol) hardening including NLA enforcement and optional complete disable",
"version": "2.2.1",
"version": "2.2.2",
"NLA_Enforcement": {
"description": "Network Level Authentication (NLA) enforcement settings",

View file

@ -186,22 +186,34 @@ function Backup-AdvancedSecuritySettings {
# 8. Firewall Rules Snapshot
Write-Host ""
Write-Host " ============================================" -ForegroundColor Cyan
Write-Host " FIREWALL RULES BACKUP - PLEASE WAIT" -ForegroundColor Cyan
Write-Host " ============================================" -ForegroundColor Cyan
Write-Host " Creating snapshot for risky ports..." -ForegroundColor White
Write-Host " Creating firewall snapshot for risky ports..." -ForegroundColor Cyan
Write-Host " Ports: 79, 137-139, 1900, 2869, 5355, 3702, 5353, 5357, 5358" -ForegroundColor Gray
Write-Host ""
Write-Host " [!] This operation takes 60-120 seconds" -ForegroundColor Yellow
Write-Host " System is working - do not interrupt!" -ForegroundColor Yellow
Write-Host " ============================================" -ForegroundColor Cyan
Write-Host ""
Write-Log -Level INFO -Message "Backing up firewall rules snapshot for risky ports (79, 137, 138, 139, 1900, 2869, 5355, 3702, 5353, 5357, 5358)..." -Module "AdvancedSecurity"
$firewallRules = Get-NetFirewallRule | Where-Object {
$portFilter = $_ | Get-NetFirewallPortFilter
(($portFilter.LocalPort -in @(79, 137, 138, 139, 1900, 2869, 5355, 3702, 5353, 5357, 5358)) -or
($portFilter.RemotePort -in @(79, 137, 138, 139, 1900, 2869, 5355, 3702, 5353, 5357, 5358))) -and
($_.Direction -eq 'Inbound' -or $_.Direction -eq 'Outbound')
# PERFORMANCE FIX: Batch query instead of per-rule queries
# Old approach: Get-NetFirewallRule | ForEach { Get-NetFirewallPortFilter } = 300+ queries × 200ms = 60-120s!
# New approach: Get all port filters once, then filter via hashtable = 2-5s total
$riskyPorts = @(79, 137, 138, 139, 1900, 2869, 5355, 3702, 5353, 5357, 5358)
# Step 1: Get all firewall rules once
$allRules = Get-NetFirewallRule -ErrorAction SilentlyContinue
# Step 2: Get all port filters in one batch query and build hashtable by InstanceID
$allPortFilters = @{}
Get-NetFirewallPortFilter -ErrorAction SilentlyContinue | ForEach-Object {
$allPortFilters[$_.InstanceID] = $_
}
# Step 3: Filter rules by risky ports (fast hashtable lookup)
$firewallRules = $allRules | Where-Object {
$portFilter = $allPortFilters[$_.InstanceID]
if ($portFilter) {
(($portFilter.LocalPort -in $riskyPorts) -or ($portFilter.RemotePort -in $riskyPorts)) -and
($_.Direction -eq 'Inbound' -or $_.Direction -eq 'Outbound')
}
else {
$false
}
} | Select-Object Name, DisplayName, Enabled, Direction, Action
$firewallData = @{

View file

@ -21,7 +21,7 @@ function Block-FingerProtocol {
.NOTES
Author: NexusOne23
Version: 2.2.1
Version: 2.2.2
Requires: Administrator privileges
REFERENCES:

View file

@ -41,16 +41,22 @@ function Disable-RiskyPorts {
$disabledRules = 0
$errors = @()
# PERFORMANCE: Get all firewall rules ONCE and cache port filters
# PERFORMANCE FIX: Batch query instead of per-rule queries
# Old approach: foreach { Get-NetFirewallPortFilter } = 300+ queries × 200ms = 60s+
# New approach: Get all port filters once via hashtable = 2-5s total
Write-Log -Level INFO -Message "Loading firewall rules for analysis..." -Module "AdvancedSecurity"
$allRules = Get-NetFirewallRule | Where-Object { $_.Direction -eq 'Inbound' -and $_.Enabled -eq $true }
$allRules = Get-NetFirewallRule -ErrorAction SilentlyContinue | Where-Object { $_.Direction -eq 'Inbound' -and $_.Enabled -eq $true }
# Pre-fetch port filters to avoid repeated Get-NetFirewallPortFilter calls
# NOTE: We cache both the rule and its ports so we can later filter ONLY
# ALLOW rules for disabling. NoID block rules must remain enabled.
# Get all port filters in one batch query and build hashtable by InstanceID
$allPortFilters = @{}
Get-NetFirewallPortFilter -ErrorAction SilentlyContinue | ForEach-Object {
$allPortFilters[$_.InstanceID] = $_
}
# Build cache with fast hashtable lookup
$rulesWithPorts = @()
foreach ($rule in $allRules) {
$portFilter = $rule | Get-NetFirewallPortFilter -ErrorAction SilentlyContinue
$portFilter = $allPortFilters[$rule.InstanceID]
if ($portFilter) {
$rulesWithPorts += [PSCustomObject]@{
Rule = $rule

View file

@ -27,7 +27,7 @@ function Set-SRPRules {
.NOTES
Author: NexusOne23
Version: 2.2.1
Version: 2.2.2
Requires: Administrator privileges
REFERENCES:

View file

@ -22,7 +22,7 @@ function Set-WindowsUpdate {
.NOTES
Author: NexusOne23
Version: 2.2.1
Version: 2.2.2
Requires: Administrator privileges
Based on: Windows Settings > Windows Update > Advanced options
#>

View file

@ -11,7 +11,7 @@ function Invoke-AdvancedSecurity {
- Enterprise: Conservative approach with domain-safety checks
- Maximum: Maximum hardening for air-gapped/high-security environments
Features implemented (v2.2.1):
Features implemented (v2.2.2):
- RDP NLA enforcement + optional complete disable
- WDigest credential protection
- Administrative shares disable (domain-aware)

View file

@ -1,6 +1,6 @@
@{
RootModule = 'AntiAI.psm1'
ModuleVersion = '2.2.1'
ModuleVersion = '2.2.2'
GUID = 'f8e9d7c6-5b4a-3c2d-1e0f-9a8b7c6d5e4f'
Author = 'NexusOne23'
CompanyName = 'Open Source Project'

View file

@ -11,7 +11,7 @@
.NOTES
Module: AntiAI
Version: 2.2.1
Version: 2.2.2
Author: NoID Privacy
#>
@ -29,7 +29,7 @@ $privateFunctions = @(
'Disable-Recall'
'Set-RecallProtection'
'Disable-Copilot'
'Disable-CopilotAdvanced' # NEW v2.2.1: URI handlers, Edge sidebar, Recall export
'Disable-CopilotAdvanced' # NEW v2.2.2: URI handlers, Edge sidebar, Recall export
'Disable-ClickToDo'
'Disable-SettingsAgent'
'Disable-ExplorerAI' # NEW: File Explorer AI Actions menu

View file

@ -40,7 +40,7 @@
.NOTES
Requires Administrator privileges.
Part of NoID Privacy AntiAI Module v2.2.1
Part of NoID Privacy AntiAI Module v2.2.2
#>
function Disable-CopilotAdvanced {
[CmdletBinding()]

View file

@ -42,7 +42,7 @@
.NOTES
Author: NoID Privacy
Version: 2.2.1 (Extended validation)
Version: 2.2.2 (Extended validation)
Requires: Windows 11 24H2+, Administrator privileges
#>

View file

@ -52,7 +52,7 @@
.NOTES
Author: NoID Privacy
Version: 2.2.1
Version: 2.2.2
Requires: Windows 11 24H2 or later, Administrator privileges
Impact: All AI features completely disabled, reboot required
#>
@ -70,7 +70,7 @@ function Invoke-AntiAI {
Write-Host "" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan
Write-Host " ANTI-AI MODULE v2.2.1" -ForegroundColor Cyan
Write-Host " ANTI-AI MODULE v2.2.2" -ForegroundColor Cyan
Write-Host "========================================" -ForegroundColor Cyan
Write-Host ""
Write-Host "Disables 15 AI features (32 policies):" -ForegroundColor White
@ -171,7 +171,7 @@ function Invoke-AntiAI {
@{ Path = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\Paint"; Name = "DisableImageCreator"; Type = "DWord" },
@{ Path = "HKLM:\SOFTWARE\Policies\WindowsNotepad"; Name = "DisableAIFeatures"; Type = "DWord" },
@{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "DisableSettingsAgent"; Type = "DWord" },
# NEW v2.2.1: Advanced Copilot Blocking
# NEW v2.2.2: Advanced Copilot Blocking
@{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsAI"; Name = "AllowRecallExport"; Type = "DWord" },
@{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; Name = "EdgeSidebarEnabled"; Type = "DWord" },
@{ Path = "HKLM:\SOFTWARE\Policies\Microsoft\Edge"; Name = "ShowHubsSidebar"; Type = "DWord" },
@ -355,7 +355,7 @@ function Invoke-AntiAI {
}
# ============================================================================
# ADVANCED COPILOT BLOCKING (NEW v2.2.1)
# ADVANCED COPILOT BLOCKING (NEW v2.2.2)
# ============================================================================
Write-Host ""
Write-Host " [Advanced Copilot Blocks]" -ForegroundColor Cyan

View file

@ -2,7 +2,7 @@
# Module manifest for DNS module
RootModule = 'DNS.psm1'
ModuleVersion = '2.2.1'
ModuleVersion = '2.2.2'
GUID = 'a8f7b3c9-4e5d-4a2b-9c1d-8f3e5a7b9c2d'
Author = 'NexusOne23'
CompanyName = 'Open Source Project'

View file

@ -12,7 +12,7 @@
.NOTES
Author: NoID Privacy
Version: 2.2.1
Version: 2.2.2
Requires: PowerShell 5.1+, Administrator privileges
#>

View file

@ -3,7 +3,7 @@
RootModule = 'EdgeHardening.psm1'
# Version number of this module
ModuleVersion = '2.2.1'
ModuleVersion = '2.2.2'
# ID used to uniquely identify this module
GUID = '8e3f4c2a-9b1d-4e7a-a2c5-6f8b3d9e1a4c'
@ -48,7 +48,7 @@
LicenseUri = ''
ProjectUri = ''
ReleaseNotes = @"
v2.2.1 - Production Release
v2.2.2 - Production Release
- Microsoft Edge v139 Security Baseline implementation
- 20 security policies (native PowerShell, no LGPO.exe)
- SmartScreen enforcement with override prevention

View file

@ -16,7 +16,7 @@
.NOTES
Author: NexusOne23
Version: 2.2.1
Version: 2.2.2
Requires: PowerShell 5.1+, Administrator privileges
#>

View file

@ -48,7 +48,7 @@
.NOTES
Author: NexusOne23
Version: 2.2.1
Version: 2.2.2
Requires: PowerShell 5.1+, Administrator privileges
IMPORTANT: This applies Microsoft's recommended security baseline.

View file

@ -23,7 +23,7 @@
.NOTES
Author: NexusOne23
Version: 2.2.1
Version: 2.2.2
Can be run without Administrator privileges
#>

View file

@ -1,6 +1,6 @@
@{
RootModule = 'Privacy.psm1'
ModuleVersion = '2.2.1'
ModuleVersion = '2.2.2'
GUID = 'a9f7c8d3-2e5b-4a1f-9c3d-7e8f5a6b2c4d'
Author = 'NexusOne23'
CompanyName = 'Open Source Project'

View file

@ -16,7 +16,7 @@
.NOTES
Module: Privacy
Version: 2.2.1
Version: 2.2.2
Author: NoID Privacy
#>

View file

@ -38,12 +38,12 @@ function Backup-PrivacySettings {
"HKLM:\SOFTWARE\Policies\Microsoft\WindowsStore",
"HKLM:\SOFTWARE\Policies\Microsoft\Dsh",
"HKLM:\SOFTWARE\Policies\Microsoft\FindMyDevice",
"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\TextInput", # AllowLinguisticDataCollection (v2.2.1)
"HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\TextInput", # AllowLinguisticDataCollection (v2.2.2)
"HKLM:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics",
# HKCU User Keys
"HKCU:\Software\Policies\Microsoft\Windows\Explorer",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\AdvertisingInfo",
# NEW: Anti-Advertising & Search Settings (v2.2.1)
# NEW: Anti-Advertising & Search Settings (v2.2.2)
"HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\Search",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\SearchSettings",
@ -52,7 +52,7 @@ function Backup-PrivacySettings {
"HKCU:\Software\Microsoft\Windows\CurrentVersion\SystemSettings\AccountNotifications",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\UserProfileEngagement",
"HKCU:\SOFTWARE\Microsoft\Personalization\Settings",
# NEW: Input Personalization Settings (v2.2.1 - FIX missing HKCU backup)
# NEW: Input Personalization Settings (v2.2.2 - FIX missing HKCU backup)
"HKCU:\SOFTWARE\Microsoft\InputPersonalization",
"HKCU:\SOFTWARE\Microsoft\InputPersonalization\TrainedDataStore",
"HKCU:\Software\Microsoft\Windows\CurrentVersion\CapabilityAccessManager\ConsentStore\appDiagnostics"

View file

@ -354,7 +354,7 @@ function Invoke-PrivacyHardening {
$bloatwareListPath = Join-Path $moduleBackupPath "REMOVED_APPS_LIST.txt"
$listContent = @()
$listContent += "================================================================"
$listContent += " REMOVED APPS - NoID Privacy v2.2.1"
$listContent += " REMOVED APPS - NoID Privacy v2.2.2"
$listContent += " Session: $(Split-Path $moduleBackupPath -Leaf)"
$listContent += " Date: $(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')"
$listContent += "================================================================"

View file

@ -44,7 +44,7 @@
.NOTES
Author: NexusOne23
Version: 2.2.1 - Self-Contained Edition
Version: 2.2.2 - Self-Contained Edition
Requires: PowerShell 5.1+, Administrator privileges
BREAKING CHANGE from v1.0:

View file

@ -1,6 +1,6 @@
@{
RootModule = 'SecurityBaseline.psm1'
ModuleVersion = '2.2.1'
ModuleVersion = '2.2.2'
GUID = 'a1b2c3d4-e5f6-7890-abcd-ef1234567890'
Author = 'NexusOne23'
CompanyName = 'Open Source Project'
@ -26,7 +26,7 @@
LicenseUri = ''
ProjectUri = ''
ReleaseNotes = @"
v2.2.1 - Self-Contained Edition
v2.2.2 - Self-Contained Edition
- NO LGPO.exe REQUIRED! Fully self-contained implementation
- 425 Microsoft Security Baseline settings for Windows 11 25H2
- 335 Registry policies (Computer + User)

View file

@ -13,7 +13,7 @@
.NOTES
Author: NexusOne23
Version: 2.2.1
Version: 2.2.2
Requires: PowerShell 5.1+, Administrator privileges
#>