Repository: microsoft/CSS-Exchange
File: Diagnostics/AVTester/Test-ExchAVExclusions.ps1 (PowerShell)

Code before:
        $ModuleAllowList.add("HealthServicePerformance.dll")
        $ModuleAllowList.add("InterceptCounters.dll")
        $ModuleAllowList.add("MOMConnectorPerformance.dll")
        $ModuleAllowList.add("ExDbFailureItemApi.dll")
        $ModuleAllowList.add("Microsoft.Cloud.InstrumentationFramework.Metrics.dll")
        $ModuleAllowList.add("IfxMetrics.dll")
        $ModuleAllowList.add("ManagedBlingSigned.dll")
        $ModuleAllowList.add("l3codecp.acm")
        $ModuleAllowList.add("System.IdentityModel.Tokens.jwt.dll")
        $ModuleAllowList.add("prxyqry.DLL")
        # Oracle modules associated with 'Outside In® Technology'
        $ModuleAllowList.add("wvcore.dll")
        $ModuleAllowList.add("sccut.dll")
        $ModuleAllowList.add("sccfut.dll")
        $ModuleAllowList.add("sccfa.dll")
        $ModuleAllowList.add("sccfi.dll")
        $ModuleAllowList.add("sccch.dll")
        $ModuleAllowList.add("sccda.dll")
        $ModuleAllowList.add("sccfmt.dll")
        $ModuleAllowList.add("sccind.dll")
        $ModuleAllowList.add("sccca.dll")
        $ModuleAllowList.add("scclo.dll")
        $ModuleAllowList.add("SCCOLE2.dll")
        $ModuleAllowList.add("SCCSD.dll")
        $ModuleAllowList.add("SCCXT.dll")
        $ModuleAllowList.add("vshtml.dll")
        # cSpell:enable

        Write-SimpleLogFile -string ("Allow List Module Count: " + $ModuleAllowList.count) -LogFile $LogFileName

        # Gather each process and work thru their module list to remove any known modules.
        foreach ($process in $ServerProcess) {

            Write-Progress -Activity "Checking Exchange Processes" -CurrentOperation "$currentDiff More Seconds" -PercentComplete ((($initialDiff - $currentDiff) / $initialDiff) * 100) -Status " "
            [int]$currentDiff = (New-TimeSpan -End $StartDate.AddMinutes($WaitingTimeForAVAnalysisInMinutes) -Start (Get-Date)).TotalSeconds

            # Determine if it is a known exchange process
            if ($ProcessList -contains $process.path ) {

                # Gather all modules
                [array]$ProcessModules = $process.modules

                # Remove Microsoft modules
                $ProcessModules = $ProcessModules | Where-Object { $_.FileVersionInfo.CompanyName -ne "Microsoft Corporation." -and $_.FileVersionInfo.CompanyName -ne "Microsoft" -and $_.FileVersionInfo.CompanyName -ne "Microsoft Corporation" }

                # Clear out modules from the allow list
                foreach ($module in $ModuleAllowList) {
                    $ProcessModules = $ProcessModules | Where-Object { $_.ModuleName -ne $module -and $_.ModuleName -ne $($module.Replace(".dll", ".ni.dll")) }
                }

                if ($ProcessModules.count -gt 0) {

Review comment (suggestion):
looks like there are a lot of possible dlls that we can load from that location (`C:\Program Files\Microsoft\Exchange Server\V15\FIP-FS\Bin\TE_v.8.5.3.0`) might be best to avoid this happening again moving forward is to account for this somehow. 

Code after:
        $ModuleAllowList.add("HealthServicePerformance.dll")
        $ModuleAllowList.add("InterceptCounters.dll")
        $ModuleAllowList.add("MOMConnectorPerformance.dll")
        $ModuleAllowList.add("ExDbFailureItemApi.dll")
        $ModuleAllowList.add("Microsoft.Cloud.InstrumentationFramework.Metrics.dll")
        $ModuleAllowList.add("IfxMetrics.dll")
        $ModuleAllowList.add("ManagedBlingSigned.dll")
        $ModuleAllowList.add("l3codecp.acm")
        $ModuleAllowList.add("System.IdentityModel.Tokens.jwt.dll")
        $ModuleAllowList.add("prxyqry.DLL")
        # cSpell:enable

        Write-SimpleLogFile -string ("Allow List Module Count: " + $ModuleAllowList.count) -LogFile $LogFileName

        # Gather each process and work thru their module list to remove any known modules.
        foreach ($process in $ServerProcess) {

            Write-Progress -Activity "Checking Exchange Processes" -CurrentOperation "$currentDiff More Seconds" -PercentComplete ((($initialDiff - $currentDiff) / $initialDiff) * 100) -Status " "
            [int]$currentDiff = (New-TimeSpan -End $StartDate.AddMinutes($WaitingTimeForAVAnalysisInMinutes) -Start (Get-Date)).TotalSeconds

            # Determine if it is a known exchange process
            if ($ProcessList -contains $process.path ) {

                # Gather all modules
                [array]$ProcessModules = $process.modules

                # Remove Microsoft modules
                $ProcessModules = $ProcessModules | Where-Object { $_.FileVersionInfo.CompanyName -ne "Microsoft Corporation." -and $_.FileVersionInfo.CompanyName -ne "Microsoft" -and $_.FileVersionInfo.CompanyName -ne "Microsoft Corporation" }

                # Remove Oracle modules on FIPS
                $ProcessModules = $ProcessModules | Where-Object { (-not($_.FileName -like "*\FIP-FS\Bin\*" -and $_.FileVersionInfo.CompanyName -eq "Oracle Corporation")) }

                # Clear out modules from the allow list
                foreach ($module in $ModuleAllowList) {
                    $ProcessModules = $ProcessModules | Where-Object { $_.ModuleName -ne $module -and $_.ModuleName -ne $($module.Replace(".dll", ".ni.dll")) }
                }

                if ($ProcessModules.count -gt 0) {
                    foreach ($module in $ProcessModules) {
                        $OutString = ("PROCESS: $($process.ProcessName) PID($($process.Id)) UNEXPECTED MODULE: $($module.ModuleName) COMPANY: $($module.Company)`n`tPATH: $($module.FileName)")
                        Write-SimpleLogFile -string "[FAIL] - $OutString" -LogFile $LogFileName -OutHost
                        if ($process.MainModule.ModuleName -eq "W3wp.exe") {
                            $SuspiciousW3wpProcessList += $OutString
                        } else {
                            $SuspiciousProcessList += $OutString
                        }
                    }
                }
            }
        }
        $firstExecution = $false