TMA-INTUNE-DEFENDER-2.12

Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher

中レベル 1自動intune-defender

説明

This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. The recommended state for this setting is: Audit. Configuring this setting to Block also conforms to the benchmark. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry d4f940ab-401b-4efc-aadc-ad5f3c50688a=1 or d4f940ab-401b-4efc-aadc-ad5f3c50688a=2 (Block, or Audit for the "Audit or higher" wording).

チェック方法

監査方法: Windows レジストリ

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('d4f940ab-401b-4efc-aadc-ad5f3c50688a=1','d4f940ab-401b-4efc-aadc-ad5f3c50688a=2'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Audit or Block. Defender\Block all Office applications from creating child processes

プロパティ

オペレーティングシステム: すべて
タグ: intune-defenderintuneregistry
参照: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.12 Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target intune-defender