Ensure 'ASR: Block abuse of exploited vulnerable signed drivers' is set to 'Block'

SrednjaNivo 1Automatskaintune-defender

Opis

This rule prevents an application from writing a vulnerable signed driver to disk. The recommended state for this setting is: Block. Note: The Block abuse of exploited vulnerable signed drivers setting does not block a driver that already exists on the system from being loaded. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry 56a863a9-875e-4185-98a7-b882c64b5ce5=1 (Block).

Kako se proverava

Metod provere: Windows registar

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('56a863a9-875e-4185-98a7-b882c64b5ce5=1'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Block. Defender\Block abuse of exploited vulnerable signed drivers (Device)

Svojstva

Operativni sistemi: Bilo koji
Oznake: intune-defenderintuneregistry
Referenca: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.10 Ensure 'ASR: Block abuse of exploited vulnerable signed drivers' is set to 'Block'

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target intune-defender