TMA-INTUNE-DEFENDER-2.12

Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher

MittelStufe 1Automatisiertintune-defender

Beschreibung

This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. The recommended state for this setting is: Audit. Configuring this setting to Block also conforms to the benchmark. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry d4f940ab-401b-4efc-aadc-ad5f3c50688a=1 or d4f940ab-401b-4efc-aadc-ad5f3c50688a=2 (Block, or Audit for the "Audit or higher" wording).

So wird geprüft

Prüfmethode: Windows-Registrierung

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('d4f940ab-401b-4efc-aadc-ad5f3c50688a=1','d4f940ab-401b-4efc-aadc-ad5f3c50688a=2'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Audit or Block. Defender\Block all Office applications from creating child processes

Eigenschaften

Betriebssysteme: Beliebig
Tags: intune-defenderintuneregistry
Referenz: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.12 Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target intune-defender