TMA-INTUNE-DEFENDER-2.10

Ensure 'ASR: Block abuse of exploited vulnerable signed drivers' is set to 'Block'

OrtaDüzey 1Otomatikintune-defender

Açıklama

This rule prevents an application from writing a vulnerable signed driver to disk. The recommended state for this setting is: Block. Note: The Block abuse of exploited vulnerable signed drivers setting does not block a driver that already exists on the system from being loaded. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry 56a863a9-875e-4185-98a7-b882c64b5ce5=1 (Block).

Nasıl denetlenir

Denetim yöntemi: Windows kayıt defteri

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('56a863a9-875e-4185-98a7-b882c64b5ce5=1'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Block. Defender\Block abuse of exploited vulnerable signed drivers (Device)

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: intune-defenderintuneregistry
Referans: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.10 Ensure 'ASR: Block abuse of exploited vulnerable signed drivers' is set to 'Block'

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target intune-defender