Proactive Remediations - Security Recommendations Defender Endpoint

Question

Hello,&nbsp;Really stupid question - has anybody written detection and remediation PowerShell scripts for the following1.&nbsp; Disable Adobe Flash - Adobe DC Reader2.&nbsp; Disable Java Script - Adobe DC Reader3.&nbsp; ASR - Block persistence through WMI Event subscription.&nbsp;This is probably not a problem for most of you as your systems are joined to a domainHowever most of mine are not and are managed - yeah I know - don't say it.Since Endpoint Analytics proactive remediation is not an option in a non joined scenario I need to run the PowerShell scripts within Intune to force the issue.&nbsp;Thanks for your patience, and if you can share your scripts I would be truly grateful.&nbsp;I might add - why has Microsoft not added these by default, even if they are not active.&nbsp; I obviously have a lot to learn, so if you have a lot of patience - feel free.&nbsp; I learn quickly.&nbsp;I also note that a lot of security recommendations need alterations to the registry, so If you have one of these PowerShell scripts lying about, I wouldn't mind a look either.&nbsp;I have attached a screenshot of my current security level.&nbsp; I though I was doing well&nbsp;Sincerely.A amateur Admin, but keen to learn and get certified.&nbsp;

thijs lecomte · Answer

Have you checked out regular Powershell script in Intune? These might suit you better, you can also sign these (but should also be possible with proactive remediations)

Btw: this setting is currently in development to be configured through the portal. If I were you I would hold on a little longer and configure it natively. https://docs.microsoft.com/en-us/mem/intune/fundamentals/in-development#new-setting-for-attack-surface-reduction-rules-to-block-malware-from-gaining-persistence-through-wmi

thijs lecomte · Answer

HiFirst off, you stated 'Proactive remediation is not an option in a non joined scenario'. As long as your devices are hybrid AD joined or AAD Joined, you are good to go. What join method are you using?I would recommend not using proactive remediations to configure settings as they can become quite cumbersome to maintain. I would advise to use different Intune profiles.For ASR for example: https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/enable-attack-surface-reduction#intuneFor the Adobe Reader, I would try to use a 'MST' configuration file during installation =&gt; https://www.adobe.com/devnet-docs/acrobatetk/tools/Wizard/basics.htmlWould this solve your issue?

braedachau · Answer

Thijs Lecomte&nbsp;&nbsp;Thanks for your reply.You cant disable persistence via WMI via Intune.&nbsp;This one you can&nbsp; - GUID - d1e49aac-8f56-4280-b9ba-993a6d77406cThis one you cant - GUID -&nbsp;&nbsp;e6db77e5-3df2-4cf1-b95a-636979351e5b&nbsp;As explained here&nbsp;https://docs.microsoft.com/en-us/windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction&nbsp;It requires a PowerShell script to be written, signed with both the script and the signing certificate published to Windows endpoints.&nbsp; I haven't signed the PowerShell script yet and are figuring out a safe way to store it "publicly" - I have no website so are thinking about putting them into a SharePoint site that is available to all.&nbsp; I have run the PowerShell ASR script locally on 3 test machines and are waiting for Defender Endpoint to report back to see if the recommendation closes on these machines (which it should as this happens when I close recommendations on a test machine (test) then the entire tenant).&nbsp;I will get back to you asap (probably a week - my day job isn't info tech) on the Acrobat problem and your recommendation, but now might investigate if I can close these via hash blocks in Defender Endpoint (some additional testing now required on how Acrobat runs java and flash).&nbsp;Thanks.&nbsp;&nbsp;

braedachau · Answer

Thijs Lecomte&nbsp;&nbsp;I have enabled this via PowerShell although I found issues with Azure AD and Intune&nbsp;I will move this to the native solution when available and keep developing PowerShell scripts to deploy to fix the other short comings.&nbsp;Thanks&nbsp;&nbsp;&nbsp;

lassaad · Answer

braedachau&nbsp;&nbsp;Hello ,#Disable autorun/autoplay on all drivesreg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Explorer" /v NoAutoplayfornonVolume /t REG_DWORD /d 1 /freg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer" /v NoDriveTypeAutoRun /t REG_DWORD /d 255 /freg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoAutorun /t REG_DWORD /d 1 /f#Disable Flash on Adobe Reader DC : Flash is an unsecure technology with many known vulnerabilitiesREG ADD "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bEnableFlash /t REG_DWORD /d 0 /f#Disable JavaScript on Adobe Reader DCreg add "HKLM\SOFTWARE\Policies\Adobe\Acrobat Reader\DC\FeatureLockDown" /v bDisableJavaScript /t REG_DWORD /d 00000001 /f&nbsp;&nbsp;

Forum Discussion

Proactive Remediations - Security Recommendations Defender Endpoint

Share

Resources