Microsoft Defender のマルウェア検知イベントを通知してみた

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "sns:Publish",
            "Resource": "arn:aws:sns:ap-northeast-1:xxxxxxxxxxxx:YourTopicName"
        }
    ]
}

# SNS トピック ARN
$topicArn = "arn:aws:sns:ap-northeast-1:xxxxxxxxxxxx:YourTopicName"
# インスタンスIDを取得
$instanceId= Get-EC2InstanceMetadata -Category InstanceId 
# イベントログから最新のイベントID 1116 を取得
$event = Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | Where-Object { $_.Id -eq 1116 } | Select-Object -First 1

if ($event) {
    # イベントの詳細を取得
    $eventMessage = $event.Message
    $eventTime = $event.TimeCreated

    # SNS メッセージ内容
    $message = "Microsoft Defender detected malware on EC2 instance $instanceId at $eventTime." + `
               [Environment]::NewLine + "Details: $eventMessage"

    # SNS トピックに通知を送信
    Publish-SNSMessage -TopicArn $topicArn -Message $message
}

$Action = New-ScheduledTaskAction -Execute 'powershell.exe' -Argument '-ExecutionPolicy Bypass -File "C:\Script\Send-SNSTopic.ps1"'
$Principal = New-ScheduledTaskPrincipal -UserId "SYSTEM" -LogonType ServiceAccount -RunLevel Highest
$Settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -StartWhenAvailable -RunOnlyIfNetworkAvailable
$CIMTriggerClass = Get-CimClass -ClassName MSFT_TaskEventTrigger -Namespace Root/Microsoft/Windows/TaskScheduler:MSFT_TaskEventTrigger
$Trigger = New-CimInstance -CimClass $CIMTriggerClass -ClientOnly
$Trigger.Subscription = 
@"
<QueryList>
  <Query Id="0" Path="Microsoft-Windows-Windows Defender/Operational">
    <Select Path="Microsoft-Windows-Windows Defender/Operational">*[System[(EventID=1116)]]</Select>
  </Query>
</QueryList>
"@
$Trigger.Enabled = $true
$Task = New-ScheduledTask -Action $Action -Principal $Principal -Trigger $Trigger -Settings $Settings
Register-ScheduledTask -TaskName "Defender Malware Detection Notification" -Action $Action -Principal $Principal -Trigger $Trigger -Settings $Settings -Force

TaskPath                                       TaskName                          State
--------                                       --------                          -----
\                                              Defender Malware Detection Not... Ready