Ensure 'ASR: Block credential stealing from the Windows local security authority subsystem' is set to 'Block'

MediumLevel 1Automatedintune-defender

Description

This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS). The recommended state for this setting is: Block. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2=1 (Block).

How it is checked

Audit method: Windows registry

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2=1'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Block. Defender\Block credential stealing from the Windows local security authority subsystem

Properties

Operating systems: Any
Tags: intune-defenderintuneregistry
Reference: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.13 Ensure 'ASR: Block credential stealing from the Windows local security authority subsystem' is set to 'Block'

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target intune-defender