---
apiVersion: v1
kind: pack
spec:
  name: windows-application-security
  queries:
  - description: Controls Bitlocker full-disk encryption settings.
    interval: 3600
    name: bitlocker_autoencrypt_settings_registry
    platform: windows
    query: bitlocker_autoencrypt_settings_registry
  - description: Controls Bitlocker full-disk encryption settings.
    interval: 3600
    name: bitlocker_fde_settings_registry
    platform: windows
    query: bitlocker_fde_settings_registry
  - description: Controls Google Chrome plugins that are forcibly installed.
    interval: 3600
    name: chrome_extension_force_list_registry
    platform: windows
    query: chrome_extension_force_list_registry
  - description: Controls EMET-protected applications and system settings.
    interval: 3600
    name: emet_settings_registry
    platform: windows
    query: emet_settings_registry
  - description: Controls Local Administrative Password Solution (LAPS) settings.
    interval: 3600
    name: microsoft_laps_settings_registry
    platform: windows
    query: microsoft_laps_settings_registry
  - description: Controls Windows Passport for Work (Hello) settings.
    interval: 3600
    name: passport_for_work_settings_registry
    platform: windows
    query: passport_for_work_settings_registry
  - description: Controls UAC. A setting of 0 indicates that UAC is disabled.
    interval: 3600
    name: uac_settings_registry
    platform: windows
    query: uac_settings_registry
  targets:
    labels: 
    - MS Windows
---
apiVersion: v1
kind: query
spec:
  description: Controls Bitlocker full-disk encryption settings.
  name: bitlocker_autoencrypt_settings_registry
  query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Bitlocker\%%';
---
apiVersion: v1
kind: query
spec:
  description: Controls Bitlocker full-disk encryption settings.
  name: bitlocker_fde_settings_registry
  query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\FVE\%%';
---
apiVersion: v1
kind: query
spec:
  description: Controls Google Chrome plugins that are forcibly installed.
  name: chrome_extension_force_list_registry
  query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\ExtensionInstallForcelist';
---
apiVersion: v1
kind: query
spec:
  description: Controls EMET-protected applications and system settings.
  name: emet_settings_registry
  query: SELECT * FROM registry WHERE key LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\EMET\%%';
---
apiVersion: v1
kind: query
spec:
  description: Controls Local Administrative Password Solution (LAPS) settings.
  name: microsoft_laps_settings_registry
  query: SELECT * FROM registry WHERE key='HKEY_LOCAL_MACHINE\Software\Policies\Microsoft
    Services\AdmPwd';
---
apiVersion: v1
kind: query
spec:
  description: Controls Windows Passport for Work (Hello) settings.
  name: passport_for_work_settings_registry
  query: SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\PassportForWork\%%';
---
apiVersion: v1
kind: query
spec:
  description: Controls UAC. A setting of 0 indicates that UAC is disabled.
  name: uac_settings_registry
  query: SELECT * FROM registry WHERE path='HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA';
