Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher

中级别 1自动化intune-defender

说明

This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access. The recommended state for this setting is: Audit. Configuring this setting to Block also conforms to the benchmark. Audit: reads the Intune PolicyManager ASR rules value (via the WinningProvider GUID) and requires the rule entry d4f940ab-401b-4efc-aadc-ad5f3c50688a=1 or d4f940ab-401b-4efc-aadc-ad5f3c50688a=2 (Block, or Audit for the "Audit or higher" wording).

检查方式

审计方法: Windows 注册表

registry

$p = (Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\Defender' -Name 'AttackSurfaceReductionRules_WinningProvider' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules_WinningProvider'; if (-not $p) { 'non-compliant: no ASR WinningProvider' } else { $p = ([string]$p).Trim('{}'); $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\' + $p + '\default\Device\Defender'; if (-not (Test-Path $k)) { $k = 'Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\{' + $p + '}\default\Device\Defender' }; $v = (Get-ItemProperty -Path $k -Name 'AttackSurfaceReductionRules' -ErrorAction SilentlyContinue).'AttackSurfaceReductionRules'; $have = @(([string]$v) -split '\|' | ForEach-Object { $_.Trim().ToLower() }); $want = @('d4f940ab-401b-4efc-aadc-ad5f3c50688a=1','d4f940ab-401b-4efc-aadc-ad5f3c50688a=2'); if (@($want | Where-Object { $have -contains $_ }).Count -gt 0) { 'compliant' } else { 'non-compliant: ' + $v } }

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

To establish the recommended configuration via configuration profiles, set the following Settings Catalog path to Audit or Block. Defender\Block all Office applications from creating child processes

属性

操作系统: 任意
标签: intune-defenderintuneregistry
参考: CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 - 2.12 Ensure 'ASR: Block all Office applications from creating child processes' is set to 'Audit' or higher

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target intune-defender