Repository: microsoft/CSS-Exchange
File: Diagnostics/AVTester/Test-ExchAVExclusions.ps1 (PowerShell)

Code before:
$currentDiff = $initialDiff
$firstExecution = $true
$SuspiciousProcessList = New-Object Collections.Generic.List[string]
$SuspiciousW3wpProcessList = New-Object Collections.Generic.List[string]
$SuspiciousAMSIinW3wpProcessList = New-Object Collections.Generic.List[string]

# Get AMSI Dlls registered
# Define the AMSI providers registry path
$registryPath = "HKLM:\SOFTWARE\Microsoft\AMSI\Providers"

# Get all subKeys in the specified registry path
$subKeys = Get-ChildItem -Path $registryPath -ErrorAction SilentlyContinue
$AMSIDlls = New-Object Collections.Generic.List[string]

if ($subKeys) {
    # Regular expression to match the subKey names
    $regex = "[0-9A-Fa-f\-]{36}"

    # Filter the subKeys that match the regular expression and get only their names
    $matchingSubKeys = $subKeys | Where-Object { $_.Name -match $regex } | ForEach-Object { $_.PSChildName }

    if ($matchingSubKeys) {
        $AMSIDll = $null
        $AMSIDll = $matchingSubKeys | ForEach-Object { (Get-Item "HKLM:\SOFTWARE\Classes\ClSid\$_\InprocServer32" -ErrorAction SilentlyContinue).GetValue("") }
        if ($AMSIDll) {
            $AMSIDlls += $AMSIDll.trim('"')
        } else {
            Write-Host 'No AMSI Dlls was found for $subKeys, possible AMSI misconfiguration"' -ForegroundColor Red
        }
    } else {
        Write-Host 'No AMSI configuration was found for $subKeys, possible AMSI misconfiguration"' -ForegroundColor Red
    }
} else {
    Write-Host '"No AMSI Providers was found"'
}

Write-Host "Analyzing Exchange Processes"
while ($currentDiff -gt 0) {
    if ($firstExecution) {
        # Test Exchange Processes for unexpected modules
        $ExchangeProcessList = Get-ExchAVExclusionsProcess -ExchangePath $ExchangePath -MsiProductMinor ([byte]$serverExchangeInstallDirectory.MsiProductMinor)

        # Include w3wp process in the analysis
        $ExchangeProcessList += (Join-Path $env:SystemRoot '\System32\inetSrv\W3wp.exe')

        # Gather all processes on the computer and filter by the Exchange Process List
        $ServerProcess = Get-Process | Where-Object { $ExchangeProcessList -contains $_.path } | Sort-Object -Property ProcessName

        # Module allow list
        $ModuleAllowList = New-Object Collections.Generic.List[string]


Review comment (suggestion):
`$AMSIDlls` was created as a generic list, but you are using it as a static array causing it to switch. Please use `$AMSIDlls.Add(($AMSIDll.trim('"')))` instead. 

Code after:
$currentDiff = $initialDiff
$firstExecution = $true
$SuspiciousProcessList = New-Object Collections.Generic.List[string]
$SuspiciousW3wpProcessList = New-Object Collections.Generic.List[string]
$SuspiciousAMSIinW3wpProcessList = New-Object Collections.Generic.List[string]

# Get AMSI Dlls registered
# Define the AMSI providers registry path
$registryPath = "HKLM:\SOFTWARE\Microsoft\AMSI\Providers"

$subKeys = $null
$AMSIDll = New-Object Collections.Generic.List[string]
# Get all subKeys in the specified registry path
$subKeys = Get-ChildItem -Path $registryPath -ErrorAction SilentlyContinue

if ($subKeys) {
    # Regular expression to match the subKey names
    $regex = "[0-9A-Fa-f\-]{36}"

    $matchingSubKeys = $null
    # Filter the subKeys that match the regular expression and get only their names
    $matchingSubKeys = $subKeys -match $regex
    if ($matchingSubKeys) {
        foreach ($subKey in $matchingSubKeys) {
            $foundDll = (Get-Item "HKLM:\SOFTWARE\Classes\ClSid\$($subKey.PSChildName)\InprocServer32" -ErrorAction SilentlyContinue).GetValue("").trim('"')
            if ($null -eq $foundDll) {
                Write-Host 'No AMSI Dlls was found for $($subKey.PSChildName), possible AMSI misconfiguration"' -ForegroundColor Red
            } else {
                $AMSIDll.add($foundDll)
            }
        }
    } else {
        Write-Host 'No AMSI configuration was found, possible AMSI misconfiguration"' -ForegroundColor Red
    }
} else {
    Write-Host '"No AMSI Providers was found"'
}

Write-Host "Analyzing Exchange Processes"
while ($currentDiff -gt 0) {
    if ($firstExecution) {
        # Test Exchange Processes for unexpected modules
        $ExchangeProcessList = Get-ExchAVExclusionsProcess -ExchangePath $ExchangePath -MsiProductMinor ([byte]$serverExchangeInstallDirectory.MsiProductMinor)

        # Include w3wp process in the analysis
        $ExchangeProcessList += (Join-Path $env:SystemRoot '\System32\inetSrv\W3wp.exe')

        # Gather all processes on the computer and filter by the Exchange Process List
        $ServerProcess = Get-Process | Where-Object { $ExchangeProcessList -contains $_.path } | Sort-Object -Property ProcessName

        # Module allow list