From cc3ae24b134863052adc9d6f43baedd8ccc1e546 Mon Sep 17 00:00:00 2001
From: Thugeny <60202565+Thugney@users.noreply.github.com>
Date: Sun, 14 Jun 2026 19:42:23 +0200
Subject: [PATCH] feat: add Defender KEV version compliance remediation

---
 .../Detect-DefenderKevVersionCompliance.ps1   |  93 ++++++++++++++
 .../defender-kev-version-compliance/README.md |  41 ++++++
 ...Remediate-DefenderKevVersionCompliance.ps1 | 117 ++++++++++++++++++
 3 files changed, 251 insertions(+)
 create mode 100644 intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1
 create mode 100644 intune/remediations/defender-kev-version-compliance/README.md
 create mode 100644 intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1

diff --git a/intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1 b/intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1
new file mode 100644
index 0000000..aac40d6
--- /dev/null
+++ b/intune/remediations/defender-kev-version-compliance/Detect-DefenderKevVersionCompliance.ps1
@@ -0,0 +1,93 @@
+# ============================================================================
+# Eriteach Scripts
+# Author: Robel (https://github.com/Thugney)
+# Repository: https://github.com/Thugney/eriteach-scripts
+# License: MIT
+# ============================================================================
+
+<#
+.SYNOPSIS
+    Kontrollerer Microsoft Defender motor- og plattformversjon.
+
+.DESCRIPTION
+    Intune Proactive Remediation detection script for Microsoft Defender
+    Antivirus version compliance. The script checks Microsoft Defender
+    Malware Protection Engine and Antimalware Platform versions using
+    Get-MpComputerStatus.
+
+    Exit 0 = compliant.
+    Exit 1 = remediation required or detection failed.
+
+    Update the minimum versions before use. They should come from the
+    Microsoft advisory or rollout requirement you are responding to.
+
+.NOTES
+    Author: Eriteach
+    Version: 1.0
+    Intune Run Context: System
+    Run using logged-on credentials: No
+#>
+
+$LogRoot = 'C:\MK-LogFiles'
+$LogPath = Join-Path -Path $LogRoot -ChildPath 'Detect-DefenderKevVersionCompliance.log'
+
+# Example minimums. Replace with the required Microsoft Defender versions for your rollout.
+$MinimumEngineVersion = [version]'1.1.26040.8'
+$MinimumPlatformVersion = [version]'4.18.26040.7'
+
+function Write-Log {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Message,
+
+        [Parameter(Mandatory = $false)]
+        [ValidateSet('INFO', 'WARNING', 'ERROR')]
+        [string]$Level = 'INFO'
+    )
+
+    try {
+        if (-not (Test-Path -Path $LogRoot)) {
+            New-Item -Path $LogRoot -ItemType Directory -Force | Out-Null
+        }
+
+        $Timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
+        $Entry = '{0} [{1}] {2}' -f $Timestamp, $Level, $Message
+        $Entry | Out-File -FilePath $LogPath -Append -Encoding UTF8
+        Write-Host $Entry
+    }
+    catch {
+        Write-Host ('Logging failed: {0}' -f $_.Exception.Message)
+    }
+}
+
+try {
+    Write-Log -Message 'Starting Defender version compliance detection.'
+
+    $Status = Get-MpComputerStatus -ErrorAction Stop
+    $EngineVersion = [version]$Status.AMEngineVersion
+    $PlatformVersion = [version]$Status.AMProductVersion
+
+    Write-Log -Message ('AMEngineVersion={0}; AMProductVersion={1}; AntivirusSignatureVersion={2}; AntivirusSignatureLastUpdated={3}' -f $Status.AMEngineVersion, $Status.AMProductVersion, $Status.AntivirusSignatureVersion, $Status.AntivirusSignatureLastUpdated)
+
+    $EngineCompliant = $EngineVersion -ge $MinimumEngineVersion
+    $PlatformCompliant = $PlatformVersion -ge $MinimumPlatformVersion
+
+    if ($EngineCompliant -and $PlatformCompliant) {
+        Write-Log -Message 'Device is compliant with the configured Defender minimum versions.'
+        exit 0
+    }
+
+    if (-not $EngineCompliant) {
+        Write-Log -Message ('Defender engine is below minimum. Current={0}; Required={1}' -f $EngineVersion, $MinimumEngineVersion) -Level WARNING
+    }
+
+    if (-not $PlatformCompliant) {
+        Write-Log -Message ('Defender platform is below minimum. Current={0}; Required={1}' -f $PlatformVersion, $MinimumPlatformVersion) -Level WARNING
+    }
+
+    exit 1
+}
+catch {
+    Write-Log -Message ('Detection failed: {0}' -f $_.Exception.Message) -Level ERROR
+    exit 1
+}
diff --git a/intune/remediations/defender-kev-version-compliance/README.md b/intune/remediations/defender-kev-version-compliance/README.md
new file mode 100644
index 0000000..10a9d43
--- /dev/null
+++ b/intune/remediations/defender-kev-version-compliance/README.md
@@ -0,0 +1,41 @@
+# Defender KEV version compliance remediation
+
+Intune Proactive Remediation pair for checking Microsoft Defender Antivirus engine/platform versions and triggering update mechanisms when an endpoint falls below a configured minimum.
+
+## Files
+
+- `Detect-DefenderKevVersionCompliance.ps1` - exits `1` when engine or platform versions are below configured minimums.
+- `Remediate-DefenderKevVersionCompliance.ps1` - runs Defender update mechanisms and logs before/after versions.
+
+## Intended use
+
+Use this when a security advisory, known exploited vulnerability response, or internal baseline requires a specific Microsoft Defender engine/platform minimum.
+
+The script does **not** decide the minimum versions for you. Update these variables before deployment:
+
+```powershell
+$MinimumEngineVersion = [version]'1.1.26040.8'
+$MinimumPlatformVersion = [version]'4.18.26040.7'
+```
+
+## Intune settings
+
+Recommended settings:
+
+- Run this script using the logged-on credentials: **No**
+- Enforce script signature check: according to your signing model
+- Run script in 64-bit PowerShell: **Yes**
+- Assignment: pilot first, then staged rollout
+
+## Safety notes
+
+- Detection is read-only.
+- Remediation only triggers Microsoft Defender update mechanisms.
+- Both scripts log to `C:\MK-LogFiles`.
+- Use a pilot assignment first and validate Intune remediation output before broad rollout.
+
+## Related docs
+
+- Microsoft Intune remediations: https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/remediations
+- Get-MpComputerStatus: https://learn.microsoft.com/en-us/powershell/module/defender/get-mpcomputerstatus
+- Update-MpSignature: https://learn.microsoft.com/en-us/powershell/module/defender/update-mpsignature
diff --git a/intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1 b/intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1
new file mode 100644
index 0000000..884cfaa
--- /dev/null
+++ b/intune/remediations/defender-kev-version-compliance/Remediate-DefenderKevVersionCompliance.ps1
@@ -0,0 +1,117 @@
+# ============================================================================
+# Eriteach Scripts
+# Author: Robel (https://github.com/Thugney)
+# Repository: https://github.com/Thugney/eriteach-scripts
+# License: MIT
+# ============================================================================
+
+<#
+.SYNOPSIS
+    Oppdaterer Microsoft Defender og validerer motor- og plattformversjon.
+
+.DESCRIPTION
+    Intune Proactive Remediation remediation script for Microsoft Defender
+    Antivirus version compliance. The script updates Defender security
+    intelligence, triggers the local Defender command-line update mechanism,
+    and logs before/after versions for evidence.
+
+    Exit 0 = device is compliant after remediation.
+    Exit 1 = device remains below minimum or remediation failed.
+
+    Update the minimum versions before use. They should come from the
+    Microsoft advisory or rollout requirement you are responding to.
+
+.NOTES
+    Author: Eriteach
+    Version: 1.0
+    Intune Run Context: System
+    Run using logged-on credentials: No
+#>
+
+$LogRoot = 'C:\MK-LogFiles'
+$LogPath = Join-Path -Path $LogRoot -ChildPath 'Remediate-DefenderKevVersionCompliance.log'
+
+# Example minimums. Replace with the required Microsoft Defender versions for your rollout.
+$MinimumEngineVersion = [version]'1.1.26040.8'
+$MinimumPlatformVersion = [version]'4.18.26040.7'
+
+function Write-Log {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string]$Message,
+
+        [Parameter(Mandatory = $false)]
+        [ValidateSet('INFO', 'WARNING', 'ERROR')]
+        [string]$Level = 'INFO'
+    )
+
+    try {
+        if (-not (Test-Path -Path $LogRoot)) {
+            New-Item -Path $LogRoot -ItemType Directory -Force | Out-Null
+        }
+
+        $Timestamp = Get-Date -Format 'yyyy-MM-dd HH:mm:ss'
+        $Entry = '{0} [{1}] {2}' -f $Timestamp, $Level, $Message
+        $Entry | Out-File -FilePath $LogPath -Append -Encoding UTF8
+        Write-Host $Entry
+    }
+    catch {
+        Write-Host ('Logging failed: {0}' -f $_.Exception.Message)
+    }
+}
+
+function Get-DefenderVersionState {
+    $Status = Get-MpComputerStatus -ErrorAction Stop
+
+    return [PSCustomObject]@{
+        EngineVersion = [version]$Status.AMEngineVersion
+        PlatformVersion = [version]$Status.AMProductVersion
+        SignatureVersion = $Status.AntivirusSignatureVersion
+        SignatureLastUpdated = $Status.AntivirusSignatureLastUpdated
+    }
+}
+
+try {
+    Write-Log -Message 'Starting Defender version compliance remediation.'
+
+    $Before = Get-DefenderVersionState
+    Write-Log -Message ('Before: Engine={0}; Platform={1}; Signature={2}; SignatureLastUpdated={3}' -f $Before.EngineVersion, $Before.PlatformVersion, $Before.SignatureVersion, $Before.SignatureLastUpdated)
+
+    try {
+        Write-Log -Message 'Running Update-MpSignature.'
+        Update-MpSignature -ErrorAction Stop
+    }
+    catch {
+        Write-Log -Message ('Update-MpSignature failed: {0}' -f $_.Exception.Message) -Level WARNING
+    }
+
+    $MpCmdRun = Join-Path -Path $env:ProgramFiles -ChildPath 'Windows Defender\MpCmdRun.exe'
+    if (Test-Path -Path $MpCmdRun) {
+        try {
+            Write-Log -Message 'Running MpCmdRun signature update.'
+            Start-Process -FilePath $MpCmdRun -ArgumentList '-SignatureUpdate' -Wait -NoNewWindow -ErrorAction Stop
+        }
+        catch {
+            Write-Log -Message ('MpCmdRun signature update failed: {0}' -f $_.Exception.Message) -Level WARNING
+        }
+    }
+    else {
+        Write-Log -Message ('MpCmdRun not found at {0}' -f $MpCmdRun) -Level WARNING
+    }
+
+    Start-Sleep -Seconds 20
+    $After = Get-DefenderVersionState
+    Write-Log -Message ('After: Engine={0}; Platform={1}; Signature={2}; SignatureLastUpdated={3}' -f $After.EngineVersion, $After.PlatformVersion, $After.SignatureVersion, $After.SignatureLastUpdated)
+
+    if ($After.EngineVersion -ge $MinimumEngineVersion -and $After.PlatformVersion -ge $MinimumPlatformVersion) {
+        Write-Log -Message 'Device is compliant after remediation.'
+        exit 0
+    }
+
+    Write-Log -Message ('Device remains below minimum. Engine={0}/{1}; Platform={2}/{3}' -f $After.EngineVersion, $MinimumEngineVersion, $After.PlatformVersion, $MinimumPlatformVersion) -Level ERROR
+    exit 1
+}
+catch {
+    Write-Log -Message ('Remediation failed: {0}' -f $_.Exception.Message) -Level ERROR
+    exit 1
+}