public/Invoke-OctaMalwareScan.ps1
|
function Invoke-OctaMalwareScan { <# .SYNOPSIS Thin wrapper over Windows Defender's own scan engine (research.md) - triggers a real Start-MpScan and reports real Get-MpThreatDetection results. Implements no independent malware-detection logic of its own (spec.md FR-008). #> [CmdletBinding()] param( [switch]$Full ) $status = Get-MpComputerStatus -ErrorAction SilentlyContinue if (-not $status -or -not $status.AMServiceEnabled) { return [pscustomobject]@{ Status = 'DefenderNotActive' Message = 'Windows Defender is not the active antivirus engine on this system - Octa only wraps its scan, it does not implement independent detection.' } } $scanType = if ($Full) { 'FullScan' } else { 'QuickScan' } # ponytail: capture the start time BEFORE scanning - Get-MpThreatDetection returns Defender's # entire detection history for the machine, not the results of one scan. Reporting that raw # count as "ThreatsFound" by this scan overstates it, potentially by years of old, already # remediated detections. Filtering by InitialDetectionTime is the only way to answer "what # did THIS scan turn up", and the full history stays available separately so nothing is # hidden either. $scanStarted = Get-Date try { Start-MpScan -ScanType $scanType -ErrorAction Stop } catch { return [pscustomobject]@{ Status = 'Error'; Message = $_.Exception.Message } } $allDetections = @(Get-MpThreatDetection -ErrorAction SilentlyContinue) $newDetections = @($allDetections | Where-Object { $_.InitialDetectionTime -and $_.InitialDetectionTime -ge $scanStarted }) return [pscustomobject]@{ Status = 'Success' ScanType = $scanType ThreatsFound = $newDetections.Count Detections = $newDetections PreexistingKnown = $allDetections.Count - $newDetections.Count } } |