TMA-INTUNE-DEFENDER-2.11

Ensure 'ASR: Block Adobe Reader from creating child processes' is set to 'Block'

보통레벨 1자동intune-defender

설명

This rule blocks Adobe Reader from creating processes. The recommended state for this setting is: Block. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c=1 (Block).

점검 방법

감사 방식: Windows 레지스트리

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c=1'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Block. Defender\Block Adobe Reader from creating child processes

속성

운영 체제: 모두
태그: intune-defenderintuneregistry
참고 자료: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.11 Ensure 'ASR: Block Adobe Reader from creating child processes' is set to 'Block'

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target intune-defender