id: windows-script-host-enabled

info:
  name: Windows Script Host Enabled
  author: princechaddha
  severity: medium
  description: Checks if Windows Script Host is enabled, which can be used to run malicious scripts.
  impact: |
    Leaving Windows Script Host enabled may allow attackers to execute harmful scripts on the system.
  remediation: |
    Disable Windows Script Host by setting the Enabled registry key to 0.
  tags: windows,code,windows-audit

self-contained: true

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      $(Get-ItemProperty -Path 'HKLM:\Software\Microsoft\Windows Script Host\Settings' -Name 'Enabled' -ErrorAction SilentlyContinue).Enabled -eq 0

    matchers:
      - type: word
        words:
          - "True"
# digest: 4b0a00483046022100fb33f4cf89d7eb06f30fb62492d118a0ffbc0d3294e305af5378978462e89a64022100abced7d15ff4bc3ee5414d4cc8c76c6685935fda707eeea0d2e2aa220385aeba:922c64590222798bb761d5b6d8e72950