Invoke-ProcessLock

Function Invoke-ProcessLock {
<#
.SYNOPSIS

    Invoke-ProcessLock

    Author: Chris Campbell (@obscuresec)
    License: BSD 3-Clause

.DESCRIPTION

    A script that can be used to prevent the starting of any new processes
    
.EXAMPLE

    PS C:\> Invoke-ProcessLock -Delay 10
   
.LINK

    https://github.com/obscuresec/CCDC/blob/master/Invoke-ProcessLock
    http://obscuresec.com/

.NOTE

    This will be updated to prevent killing of legit processes due to name collisions.
    This script was created for CTF competitions like CCDC, don't use in production.

#>

[CmdletBinding()] Param(
        [Parameter()] [int32] $Delay = '5'
        )


    #Get allowed processes
    $LockedPS = Get-Process

        #Create function to compare against allowed processes
        Function CompareFunction {
            #Get updated process list
            $UpdatePS = Get-Process
            #Compare the listes
            $CompareObject = (Compare-Object $LockedPS $UpdatePS)

            #Look for new processes
            foreach ($Object in $CompareObject) {
                if ($Object.SideIndicator -eq '=>') {
                    [string] $Process = $Object.InputObject
                    #Parse out the new process names
                    $ProcessName = (($Process.split('(')[1]).split(')')[0])
                    Write-Verbose "The new process is $ProcessName"
                    #Find the PID of new process names
                    $ProcessID = (($UpdatePS | Where-Object { $_.ProcessName -eq "$ProcessName" }).Id)
                        #Kill new processes
                        foreach ($Process in $ProcessID) {
                            Write-Verbose "Stopping $Process"
                            Stop-Process $Process
                        }
                    }
            }
            #Sleep for the specified number of seconds
            Start-Sleep -seconds $Delay

        }
    #Loop forever so only ctrl-c will stop the function
    for (;;) {
            CompareFunction
        }
}
Invoke-ProcessLock -Verbose