# High memory remediation consent tier
# Lever 7 cancel an active Defender scan to release memory
# Runs elevated as SYSTEM idempotent safe to repeat
# Cancelling an active scan weakens a running security control and is consent gated
# Service state and MpCmdRun path are both resolved defensively before invocation
# State changes dual write to stdout and the Application event log for a tamper evident trail

$eventLogName = 'Application'
$eventSourceName = 'ZohoDEXRemediation'

function Write-RemediationEvent {
    param(
        [string]$Message,
        [int]$EventId,
        [string]$EntryType = 'Information'
    )
    Write-Output $Message
    try {
        $sourceExists = [System.Diagnostics.EventLog]::SourceExists($eventSourceName)
        if ($sourceExists -eq $false) {
            [System.Diagnostics.EventLog]::CreateEventSource($eventSourceName, $eventLogName)
        }
        $entryTypeValue = [System.Diagnostics.EventLogEntryType]::Information
        if ($EntryType -eq 'Warning') {
            $entryTypeValue = [System.Diagnostics.EventLogEntryType]::Warning
        }
        [System.Diagnostics.EventLog]::WriteEntry($eventSourceName, $Message, $entryTypeValue, $EventId)
    } catch {
        Write-Output ('audit_warn: event log write failed for event {0}' -f $EventId)
    }
}

$service = Get-Service -Name WinDefend -ErrorAction SilentlyContinue

if ($null -eq $service -or $service.Status -ne 'Running') {
    Write-Output 'skip: WinDefend service not present or not running'
    return
}

$mpCmdRunPath = $null
$legacyPath = 'C:\Program Files\Windows Defender\MpCmdRun.exe'
$platformRoot = 'C:\ProgramData\Microsoft\Windows Defender\Platform'

if (Test-Path $legacyPath) {
    $mpCmdRunPath = $legacyPath
} else {
    # Sort by parsed version, not by LastWriteTime. LastWriteTime is trivially
    # forged by touching a file, and a lexical name sort orders 4.18.9 after
    # 4.18.10, either of which could steer this at a planted or stale binary.
    # Folders that do not parse as a version are dropped rather than guessed at.
    $latestPlatform = Get-ChildItem -Path $platformRoot -Directory -ErrorAction SilentlyContinue |
            Where-Object { $null -ne ($_.Name -as [version]) } |
            Sort-Object { [version]$_.Name } -Descending |
            Select-Object -First 1

    if ($null -ne $latestPlatform) {
        $candidatePath = Join-Path $latestPlatform.FullName 'MpCmdRun.exe'
        if (Test-Path $candidatePath) {
            $mpCmdRunPath = $candidatePath
        }
    }
}

if ($null -eq $mpCmdRunPath) {
    Write-Output 'skip: MpCmdRun not found in legacy or platform paths'
    return
}

# The path above is resolved by a directory scan, so the binary is untrusted
# until proven otherwise. Verify a valid Microsoft Authenticode signature
# before running anything as SYSTEM. Without this a planted binary under a
# versioned Platform folder would execute under a trusted name.
$signature = Get-AuthenticodeSignature -FilePath $mpCmdRunPath -ErrorAction SilentlyContinue

$signerOk = $false
if ($null -ne $signature -and $signature.Status -eq 'Valid') {
    if ($null -ne $signature.SignerCertificate) {
        if ($signature.SignerCertificate.Subject -match 'O=Microsoft Corporation') {
            $signerOk = $true
        }
    }
}

if (-not $signerOk) {
    $why = 'unsigned or untrusted'
    if ($null -ne $signature) { $why = $signature.Status }
    Write-RemediationEvent -Message ('skip: MpCmdRun.exe failed Microsoft signature check ({0})' -f $why) -EventId 5208 -EntryType 'Warning'
    return
}

try {
    & $mpCmdRunPath -Scan -Cancel
    $exitCode = $LASTEXITCODE

    if ($exitCode -eq 0) {
        Write-RemediationEvent -Message 'cancelled: active Defender scan cancelled MpCmdRun exit code 0' -EventId 5207 -EntryType 'Warning'
    } else {
        Write-RemediationEvent -Message 'cancel_failed: MpCmdRun returned nonzero exit code' -EventId 5208 -EntryType 'Warning'
    }
} catch {
    Write-RemediationEvent -Message 'cancel_failed: unhandled exception invoking MpCmdRun' -EventId 5208 -EntryType 'Warning'
}