TMA-INTUNE-DEFENDER-2.12
Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher
Description
This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. The recommended state for this setting is: Audit. Configuring this setting to Block also conforms to the benchmark. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry d4f940ab-401b-4efc-aadc-ad5f3c50688a=1 or d4f940ab-401b-4efc-aadc-ad5f3c50688a=2 (Block, or Audit for the "Audit or higher" wording).
How it is checked
Audit method: Windows registry
$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('d4f940ab-401b-4efc-aadc-ad5f3c50688a=1','d4f940ab-401b-4efc-aadc-ad5f3c50688a=2'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Audit or Block. Defender\Block all Office applications from creating child processes
Properties
- Operating systems
- Any
- Tags
- intune-defenderintuneregistry
- Reference
- CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.12 Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target intune-defender