TMA-INTUNE-DEFENDER-2.15
Ensure 'ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion' is set to 'Audit' or higher
Description
This rule blocks executable files, such as .exe, .dll, or .scr, from launching. The recommended state for this setting is: Audit or higher. Configuring this setting to Block also conforms to the benchmark. Note: Cloud-delivered protection must be enabled to use this rule. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry 01443614-cd74-433a-b99e-2ecdc07bfc25=1 or 01443614-cd74-433a-b99e-2ecdc07bfc25=2 (Block, or Audit for the "Audit or higher" wording).
How it is checked
Audit method: Windows registry
$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('01443614-cd74-433a-b99e-2ecdc07bfc25=1','01443614-cd74-433a-b99e-2ecdc07bfc25=2'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Audit or Block. Defender\Block executable files from running unless they meet a prevalence, age, or trusted list criterion
Properties
- Operating systems
- Any
- Tags
- intune-defenderintuneregistry
- Reference
- CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.15 Ensure 'ASR: Block executable files from running unless they meet a prevalence, age, or trusted list criterion' is set to 'Audit' or higher
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target intune-defender