id: windows-script-host-enabled

info:
  name: Windows Script Host Enabled
  author: princechaddha
  severity: medium
  description: Checks if Windows Script Host is enabled, which can be used to run malicious scripts.
  impact: |
    Leaving Windows Script Host enabled may allow attackers to execute harmful scripts on the system.
  remediation: |
    Disable Windows Script Host by setting the Enabled registry key to 0.
  tags: windows,code,windows-audit

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      $(Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows Script Host\Settings' -Name 'Enabled' -ErrorAction SilentlyContinue).Enabled -eq 0

    matchers:
      - type: word
        words:
          - "True"