Skip to content

Commit b2f66a1

Browse files
MichaelGrafnetterMichaelGrafnetter
committed
All rules supported
1 parent 8d57fb0 commit b2f66a1

File tree

7 files changed

+618
-7
lines changed

7 files changed

+618
-7
lines changed

‎PolicyDefinitions/WindowsDefenderASR.admx‎

Lines changed: 511 additions & 5 deletions
Large diffs are not rendered by default.

‎PolicyDefinitions/en-US/WindowsDefenderASR.adml‎

Lines changed: 96 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,105 @@
66
<resources>
77
<stringTable>
88
<string id="ExploitGuard_ASR_Rules_Lsass">Block credential stealing from the Windows local security authority subsystem (lsass.exe)</string>
9-
<string id="ExploitGuard_ASR_Rules_Lsass_Explain">TODO</string>
9+
<string id="ExploitGuard_ASR_Rules_Lsass_Explain">This rule helps prevent credential stealing by blocking code injection attempts targeting lsass.exe.</string>
10+
<string id="ExploitGuard_ASR_Rules_Drivers">Block abuse of exploited vulnerable signed drivers</string>
11+
<string id="ExploitGuard_ASR_Rules_Drivers_Explain">This rule prevents exploitation of vulnerable signed drivers to escalate privileges.</string>
12+
<string id="ExploitGuard_ASR_Rules_AdobeReader">Block Adobe Reader from creating child processes</string>
13+
<string id="ExploitGuard_ASR_Rules_AdobeReader_Explain">This rule prevents Adobe Reader from creating child processes that could be used for malicious purposes.</string>
14+
<string id="ExploitGuard_ASR_Rules_Office_CreateProcess">Block all Office applications from creating child processes</string>
15+
<string id="ExploitGuard_ASR_Rules_Office_CreateProcess_Explain">This rule blocks Office applications from creating child processes to prevent malicious macro execution.</string>
16+
<string id="ExploitGuard_ASR_Rules_Email">Block executable content from email client and webmail</string>
17+
<string id="ExploitGuard_ASR_Rules_Email_Explain">This rule blocks execution of potentially malicious files from email clients and webmail.</string>
18+
<string id="ExploitGuard_ASR_Rules_SmartScreen">Block executable files from running unless they meet a prevalence, age, or trusted list criterion</string>
19+
<string id="ExploitGuard_ASR_Rules_SmartScreen_Explain">This rule helps prevent execution of suspicious or unknown executables using SmartScreen criteria.</string>
20+
<string id="ExploitGuard_ASR_Rules_Obfuscated">Block execution of potentially obfuscated scripts</string>
21+
<string id="ExploitGuard_ASR_Rules_Obfuscated_Explain">This rule blocks scripts that appear to be obfuscated to hide malicious content.</string>
22+
<string id="ExploitGuard_ASR_Rules_Script_Staging">Block JavaScript or VBScript from launching downloaded executable content</string>
23+
<string id="ExploitGuard_ASR_Rules_Script_Staging_Explain">This rule prevents scripts from launching downloaded executable files to block malware delivery.</string>
24+
<string id="ExploitGuard_ASR_Rules_Office_CreateExecutable">Block Office applications from creating executable content</string>
25+
<string id="ExploitGuard_ASR_Rules_Office_CreateExecutable_Explain">This rule prevents Office applications from creating executable files that could contain malware.</string>
26+
<string id="ExploitGuard_ASR_Rules_Office_Injection">Block Office applications from injecting code into other processes</string>
27+
<string id="ExploitGuard_ASR_Rules_Office_Injection_Explain">This rule prevents Office applications from injecting code into other processes to block malicious macro behavior.</string>
28+
<string id="ExploitGuard_ASR_Rules_OfficeComm_CreateProcess">Block Office communication application from creating child processes</string>
29+
<string id="ExploitGuard_ASR_Rules_OfficeComm_CreateProcess_Explain">This rule blocks Office communication apps from creating child processes that could be malicious.</string>
30+
<string id="ExploitGuard_ASR_Rules_WMIPersistence">Block persistence through WMI event subscription</string>
31+
<string id="ExploitGuard_ASR_Rules_WMIPersistence_Explain">This rule prevents attackers from using WMI event subscriptions for persistence.</string>
32+
<string id="ExploitGuard_ASR_Rules_PSExec">Block process creations originating from PSExec and WMI commands</string>
33+
<string id="ExploitGuard_ASR_Rules_PSExec_Explain">This rule blocks potentially malicious process creation through PSExec and WMI commands.</string>
34+
<string id="ExploitGuard_ASR_Rules_SafeMode">Block rebooting machine in Safe Mode (preview)</string>
35+
<string id="ExploitGuard_ASR_Rules_SafeMode_Explain">This rule prevents attackers from forcing system reboots into Safe Mode to bypass security controls.</string>
36+
<string id="ExploitGuard_ASR_Rules_USB">Block untrusted and unsigned processes that run from USB</string>
37+
<string id="ExploitGuard_ASR_Rules_USB_Explain">This rule blocks execution of untrusted or unsigned processes from USB devices.</string>
38+
<string id="ExploitGuard_ASR_Rules_ToolCopy">Block use of copied or impersonated system tools (preview)</string>
39+
<string id="ExploitGuard_ASR_Rules_ToolCopy_Explain">This rule prevents the use of copied or impersonated system tools that could be used maliciously.</string>
40+
<string id="ExploitGuard_ASR_Rules_Webshell">Block Webshell creation for Servers</string>
41+
<string id="ExploitGuard_ASR_Rules_Webshell_Explain">This rule helps prevent webshell creation and execution on servers.</string>
42+
<string id="ExploitGuard_ASR_Rules_Office_MacroWin32API">Block Win32 API calls from Office macros</string>
43+
<string id="ExploitGuard_ASR_Rules_Office_MacroWin32API_Explain">This rule blocks Office macros from making potentially dangerous Win32 API calls.</string>
44+
<string id="ExploitGuard_ASR_Rules_Ransomware">Use advanced protection against ransomware</string>
45+
<string id="ExploitGuard_ASR_Rules_Ransomware_Explain">This rule enables advanced protection features to prevent ransomware attacks.</string>
46+
<string id="AuditMode">Audit</string>
47+
<string id="WarnMode">Warn</string>
48+
<string id="BlockMode">Block</string>
49+
<string id="DisabledMode">Disabled</string>
1050
</stringTable>
1151
<presentationTable>
1252
<presentation id="ExploitGuard_ASR_Rules_Lsass">
13-
<dropdownList refId="ExploitGuard_ASR_Rules_Lsass_Options" defaultItem="2" noSort="true">Mode:</dropdownList>
53+
<dropdownList refId="ExploitGuard_ASR_Rules_Lsass_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
54+
</presentation>
55+
<presentation id="ExploitGuard_ASR_Rules_Drivers">
56+
<dropdownList refId="ExploitGuard_ASR_Rules_Drivers_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
57+
</presentation>
58+
<presentation id="ExploitGuard_ASR_Rules_AdobeReader">
59+
<dropdownList refId="ExploitGuard_ASR_Rules_AdobeReader_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
60+
</presentation>
61+
<presentation id="ExploitGuard_ASR_Rules_Office_CreateProcess">
62+
<dropdownList refId="ExploitGuard_ASR_Rules_Office_CreateProcess_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
63+
</presentation>
64+
<presentation id="ExploitGuard_ASR_Rules_Email">
65+
<dropdownList refId="ExploitGuard_ASR_Rules_Email_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
66+
</presentation>
67+
<presentation id="ExploitGuard_ASR_Rules_SmartScreen">
68+
<dropdownList refId="ExploitGuard_ASR_Rules_SmartScreen_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
69+
</presentation>
70+
<presentation id="ExploitGuard_ASR_Rules_Obfuscated">
71+
<dropdownList refId="ExploitGuard_ASR_Rules_Obfuscated_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
72+
</presentation>
73+
<presentation id="ExploitGuard_ASR_Rules_Script_Staging">
74+
<dropdownList refId="ExploitGuard_ASR_Rules_Script_Staging_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
75+
</presentation>
76+
<presentation id="ExploitGuard_ASR_Rules_Office_CreateExecutable">
77+
<dropdownList refId="ExploitGuard_ASR_Rules_Office_CreateExecutable_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
78+
</presentation>
79+
<presentation id="ExploitGuard_ASR_Rules_Office_Injection">
80+
<dropdownList refId="ExploitGuard_ASR_Rules_Office_Injection_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
81+
</presentation>
82+
<presentation id="ExploitGuard_ASR_Rules_OfficeComm_CreateProcess">
83+
<dropdownList refId="ExploitGuard_ASR_Rules_OfficeComm_CreateProcess_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
84+
</presentation>
85+
<presentation id="ExploitGuard_ASR_Rules_WMIPersistence">
86+
<dropdownList refId="ExploitGuard_ASR_Rules_WMIPersistence_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
87+
</presentation>
88+
<presentation id="ExploitGuard_ASR_Rules_PSExec">
89+
<dropdownList refId="ExploitGuard_ASR_Rules_PSExec_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
90+
</presentation>
91+
<presentation id="ExploitGuard_ASR_Rules_SafeMode">
92+
<dropdownList refId="ExploitGuard_ASR_Rules_SafeMode_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
93+
</presentation>
94+
<presentation id="ExploitGuard_ASR_Rules_USB">
95+
<dropdownList refId="ExploitGuard_ASR_Rules_USB_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
96+
</presentation>
97+
<presentation id="ExploitGuard_ASR_Rules_ToolCopy">
98+
<dropdownList refId="ExploitGuard_ASR_Rules_ToolCopy_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
99+
</presentation>
100+
<presentation id="ExploitGuard_ASR_Rules_Webshell">
101+
<dropdownList refId="ExploitGuard_ASR_Rules_Webshell_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
102+
</presentation>
103+
<presentation id="ExploitGuard_ASR_Rules_Office_MacroWin32API">
104+
<dropdownList refId="ExploitGuard_ASR_Rules_Office_MacroWin32API_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
105+
</presentation>
106+
<presentation id="ExploitGuard_ASR_Rules_Ransomware">
107+
<dropdownList refId="ExploitGuard_ASR_Rules_Ransomware_Options" defaultItem="1" noSort="true">Mode:</dropdownList>
14108
</presentation>
15109
</presentationTable>
16110
</resources>

‎README.md‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,21 @@
22

33
## Introduction
44

5+
![GPO Built-in Editor](/images/builtin-admx-editor.png)
6+
7+
![List of custom settings in the GPO editor](/images/custom-admx-settings-list.png)
8+
9+
TODO: Screenshot of single item editor
10+
11+
![Group Policy Result](/images/group-policy-result.png)
12+
513
## Installation
614

715
Just copy the ADMX and ADML files into the [local or central ADMX store](https://msdn.microsoft.com/en-us/library/bb530196.aspx#manageadmxfiles_topic2).
816

917
## References
1018

1119
The ADMX template is based on the following official document:
20+
21+
- [Attack surface reduction rules reference](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference)
22+
- [Enable attack surface reduction rules](https://learn.microsoft.com/en-us/defender-endpoint/enable-attack-surface-reduction#group-policy)

‎images/.gitkeep‎

Whitespace-only changes.

‎images/builtin-admx-editor.png‎

139 KB
Loading

‎images/custom-admx-settings-list.png‎

261 KB
Loading

‎images/group-policy-result.png‎

39.4 KB
Loading

0 commit comments

Comments
 (0)