TMA-INTUNE-DEFENDER-2.12

Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher

OrtaDüzey 1Otomatikintune-defender

Açıklama

This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. The recommended state for this setting is: Audit. Configuring this setting to Block also conforms to the benchmark. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry d4f940ab-401b-4efc-aadc-ad5f3c50688a=1 or d4f940ab-401b-4efc-aadc-ad5f3c50688a=2 (Block, or Audit for the "Audit or higher" wording).

Nasıl denetlenir

Denetim yöntemi: Windows kayıt defteri

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('d4f940ab-401b-4efc-aadc-ad5f3c50688a=1','d4f940ab-401b-4efc-aadc-ad5f3c50688a=2'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Audit or Block. Defender\Block all Office applications from creating child processes

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: intune-defenderintuneregistry
Referans: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.12 Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target intune-defender