Repository: microsoft/CSS-Exchange
File: Diagnostics/AVTester/Test-ExchAVExclusions.ps1 (PowerShell)

Code before:

# Test Exchange Processes for unexpected modules
$ProcessList = Get-ExchAVExclusionsProcess -ExchangePath $ExchangePath -MsiProductMinor ([byte]$serverExchangeInstallDirectory.MsiProductMinor)

# Include w3wp process in the analysis
$ProcessList += (Join-Path $env:SystemRoot '\System32\inetSrv\W3wp.exe')

# Gather all processes on the computer
$ServerProcess = Get-Process | Sort-Object -Property ProcessName

# Module allow list
$ModuleAllowList = New-Object Collections.Generic.List[string]

# cSpell:disable
$ModuleAllowList.add("Google.Protobuf.ni.dll")
$ModuleAllowList.add("Microsoft.RightsManagementServices.Core.ni.dll")
$ModuleAllowList.add("Newtonsoft.Json.ni.dll")
$ModuleAllowList.add("Microsoft.Cloud.InstrumentationFramework.Events.ni.dll")
$ModuleAllowList.add("HealthServicePerformance.dll")
$ModuleAllowList.add("InterceptCounters.dll")
$ModuleAllowList.add("MOMConnectorPerformance.dll")
$ModuleAllowList.add("ExDbFailureItemApi.dll")
$ModuleAllowList.add("Microsoft.Cloud.InstrumentationFramework.Metrics.ni.dll")
$ModuleAllowList.add("IfxMetrics.dll")
$ModuleAllowList.add("ManagedBlingSigned.dll")
$ModuleAllowList.add("ManagedBlingSigned.ni.dll")
$ModuleAllowList.add("l3codecp.acm")
$ModuleAllowList.add("System.IdentityModel.Tokens.jwt.ni.dll")
# Oracle modules associated with 'Outside In® Technology'
$ModuleAllowList.add("wvcore.dll")
$ModuleAllowList.add("sccut.dll")
$ModuleAllowList.add("sccfut.dll")
$ModuleAllowList.add("sccfa.dll")
$ModuleAllowList.add("sccfi.dll")
$ModuleAllowList.add("sccch.dll")
$ModuleAllowList.add("sccda.dll")
$ModuleAllowList.add("sccfmt.dll")
$ModuleAllowList.add("sccind.dll")
$ModuleAllowList.add("sccca.dll")
$ModuleAllowList.add("scclo.dll")
$ModuleAllowList.add("SCCOLE2.DLL")
$ModuleAllowList.add("SCCSD.DLL")
$ModuleAllowList.add("SCCXT.DLL")
# cSpell:enable

Write-SimpleLogFile -string ("Allow List Module Count: " + $ModuleAllowList.count) -Name $LogFile

$UnexpectedModuleFound = 0

$showWarning = $false
# Gather each process and work thru their module list to remove any known modules.

Review comment (suggestion):
This list should be adjusted to have the default `name.dll` files, then at the end, we also need to add in `name.ni.dll` to avoid this type of adding occurring right now we have a mixed results which we don't want. 

Code after:

# Test Exchange Processes for unexpected modules
$ProcessList = Get-ExchAVExclusionsProcess -ExchangePath $ExchangePath -MsiProductMinor ([byte]$serverExchangeInstallDirectory.MsiProductMinor)

# Include w3wp process in the analysis
$ProcessList += (Join-Path $env:SystemRoot '\System32\inetSrv\W3wp.exe')

# Gather all processes on the computer
$ServerProcess = Get-Process | Sort-Object -Property ProcessName

# Module allow list
$ModuleAllowList = New-Object Collections.Generic.List[string]

# cSpell:disable
$ModuleAllowList.add("Google.Protobuf.dll")
$ModuleAllowList.add("Microsoft.RightsManagementServices.Core.dll")
$ModuleAllowList.add("Newtonsoft.Json.dll")
$ModuleAllowList.add("Microsoft.Cloud.InstrumentationFramework.Events.dll")
$ModuleAllowList.add("HealthServicePerformance.dll")
$ModuleAllowList.add("InterceptCounters.dll")
$ModuleAllowList.add("MOMConnectorPerformance.dll")
$ModuleAllowList.add("ExDbFailureItemApi.dll")
$ModuleAllowList.add("Microsoft.Cloud.InstrumentationFramework.Metrics.dll")
$ModuleAllowList.add("IfxMetrics.dll")
$ModuleAllowList.add("ManagedBlingSigned.dll")
$ModuleAllowList.add("l3codecp.acm")
$ModuleAllowList.add("System.IdentityModel.Tokens.jwt.dll")
# Oracle modules associated with 'Outside In® Technology'
$ModuleAllowList.add("wvcore.dll")
$ModuleAllowList.add("sccut.dll")
$ModuleAllowList.add("sccfut.dll")
$ModuleAllowList.add("sccfa.dll")
$ModuleAllowList.add("sccfi.dll")
$ModuleAllowList.add("sccch.dll")
$ModuleAllowList.add("sccda.dll")
$ModuleAllowList.add("sccfmt.dll")
$ModuleAllowList.add("sccind.dll")
$ModuleAllowList.add("sccca.dll")
$ModuleAllowList.add("scclo.dll")
$ModuleAllowList.add("SCCOLE2.dll")
$ModuleAllowList.add("SCCSD.dll")
$ModuleAllowList.add("SCCXT.dll")
# cSpell:enable

Write-SimpleLogFile -string ("Allow List Module Count: " + $ModuleAllowList.count) -Name $LogFile

$UnexpectedModuleFound = 0
$showWarning = $false

# Gather each process and work thru their module list to remove any known modules.
foreach ($process in $ServerProcess) {