Ensure 'ASR: Block credential stealing from the Windows local security authority subsystem' is set to 'Block'

MédiaNível 1Automatizadaintune-defender

Descrição

This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS). The recommended state for this setting is: Block. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2=1 (Block).

Como é verificado

Método de auditoria: Registro do Windows

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2=1'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Block. Defender\Block credential stealing from the Windows local security authority subsystem

Propriedades

Sistemas operacionais: Qualquer
Tags: intune-defenderintuneregistry
Referência: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.13 Ensure 'ASR: Block credential stealing from the Windows local security authority subsystem' is set to 'Block'

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target intune-defender