TMA-INTUNE-DEFENDER-2.16

Ensure 'ASR: Block execution of potentially obfuscated scripts' is set to 'Audit' or higher

MittelStufe 1Automatisiertintune-defender

Beschreibung

This rule detects suspicious properties within an obfuscated script. The recommended state for this setting is: Audit. Configuring this setting to Block also conforms to the benchmark. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry 5beb7efe-fd9a-4556-801d-275e5ffc04cc=1 or 5beb7efe-fd9a-4556-801d-275e5ffc04cc=2 (Block, or Audit for the "Audit or higher" wording).

So wird geprüft

Prüfmethode: Windows-Registrierung

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('5beb7efe-fd9a-4556-801d-275e5ffc04cc=1','5beb7efe-fd9a-4556-801d-275e5ffc04cc=2'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Audit or Block. Defender\Block execution of potentially obfuscated scripts

Eigenschaften

Betriebssysteme: Beliebig
Tags: intune-defenderintuneregistry
Referenz: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.16 Ensure 'ASR: Block execution of potentially obfuscated scripts' is set to 'Audit' or higher

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target intune-defender