Add windows defender problem detection custom plugin

[mcshooter]

Windows Defender helps detect any malware, viruses, etc on a windows node. If windows defender detects any threats, we should indicate that there is an issue on the node. So, a custom plugin has been added to monitor this.

Get-MpThreat currently will output an empty string if no threats are detected. Anything string output that is returned will indicate that there is a threat.
If a threat has been detected, we can check if that threat had been executed or is currently active to determine the health of out node. If either is true, we return with exit 1 to indicate a problem detected from windows defender

CategoryID       : 27
DidThreatExecute : False
IsActive         : False
Resources        : {file:_C:\Users\michelletandya\Downloads\PotentiallyUnwanted.exe, file:_C:\Users\michelletandya\Downloads\potentiallyUnwanted2.exe,
                   file:_C:\Users\michelletandya\Downloads\potentiallyUnwanted2.exe, file:_C:\Users\michelletandya\Downloads\PotentiallyUnwanted (1).exe}
RollupStatus     : 33
SchemaVersion    : 1.0.0.0
SeverityID       : 5
ThreatID         : 224688
ThreatName       : PUA:Win32/EICAR_Test_File
TypeID           : 0
PSComputerName   :

[k8s-ci-robot]

Hi @mcshooter. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[mcshooter]

/cc @jeremyje

[jeremyje]

I think it'd be appropriate to make this run every 10 minutes.

[jeremyje]

https://docs.microsoft.com/en-us/powershell/module/defender/get-mpthreatdetection?view=windowsserver2019-ps

The Get-MpThreatDetection cmdlet gets active and past malware threats that Windows Defender detected on the computer.

We only want active threats unless past here means that if a threat is handled by Defender then it's no longer a problem right?

The description in the docs aren't precise enough to make a judgement here. Perhaps check with sig-windows.

[mcshooter]

Updated to use Get-MpThreat because there are fields we can use that can help us determine whether a thread is active or has been executed on the windows node.

[jeremyje]

I think it's clear to just return 0 vs 1 here. Aliasing the variables adds unnecessary indirection.

[mcshooter]

Is it common knowledge that 1 indicates a bad exit, and 0 is an OK exit? I haven't had to deal with exits before. I was thinking that the variables makes it easy to read and understand what it indicates, but if it's common knowledge then I am good to remove them and return just 0 or 1.

[jeremyje]

exit code 0 indicates success thats common

[jeremyje]

WindowsDefenderThreatsDetected

[jeremyje]

/ok-to-test
/sig windows
/sig node

[jeremyje]

#461

[jeremyje]

/ok-to-test

[mcshooter]

/retest

[mcshooter]

/retest

[mcshooter]

/retest

[jeremyje]

/lgtm
/approve
/sig windows
/sig node

[Random-Liu]

/lgtm
/approve

This looks pretty useful! Thanks for adding this!

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jeremyje, mcshooter, Random-Liu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Random-Liu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment