TMA-INTUNE-DEFENDER-2.10

Ensure 'ASR: Block abuse of exploited vulnerable signed drivers' is set to 'Block'

中レベル 1自動intune-defender

説明

This rule prevents an application from writing a vulnerable signed driver to disk. The recommended state for this setting is: Block. Note: The Block abuse of exploited vulnerable signed drivers setting does not block a driver that already exists on the system from being loaded. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry 56a863a9-875e-4185-98a7-b882c64b5ce5=1 (Block).

チェック方法

監査方法: Windows レジストリ

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('56a863a9-875e-4185-98a7-b882c64b5ce5=1'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Block. Defender\Block abuse of exploited vulnerable signed drivers (Device)

プロパティ

オペレーティングシステム: すべて
タグ: intune-defenderintuneregistry
参照: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.10 Ensure 'ASR: Block abuse of exploited vulnerable signed drivers' is set to 'Block'

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target intune-defender