DSCResources/MSFT_IntuneSettingCatalogASRRulesPolicyWindows10/MSFT_IntuneSettingCatalogASRRulesPolicyWindows10.schema.mof
|
[ClassVersion("1.0.0.0"), FriendlyName("IntuneSettingCatalogASRRulesPolicyWindows10")]
class MSFT_IntuneSettingCatalogASRRulesPolicyWindows10 : OMI_BaseResource { [Key, Description("Identity of the endpoint protection attack surface protection rules policy for Windows 10.")] String Identity; [Write, Description("Display name of the endpoint protection attack surface protection rules policy for Windows 10.")] String DisplayName; [Write, Description("Description of the endpoint protection attack surface protection rules policy for Windows 10.")] String Description; [Write, Description("Exclude files and paths from attack surface reduction rules")] String AttackSurfaceReductionOnlyExclusions[]; [Write, Description("This rule prevents an application from writing a vulnerable signed driver to disk."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockAbuseOfExploitedVulnerableSignedDrivers; [Write, Description("This rule prevents attacks by blocking Adobe Reader from creating processes."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockAdobeReaderFromCreatingChildProcesses; [Write, Description("This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockAllOfficeApplicationsFromCreatingChildProcesses; [Write, Description("This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS)."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem; [Write, Description("This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockExecutableContentFromEmailClientAndWebmail; [Write, Description("This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockExecutableFilesRunningUnlessTheyMeetPrevalenceAgeTrustedListCriterion; [Write, Description("This rule detects suspicious properties within an obfuscated script."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockExecutionOfPotentiallyObfuscatedScripts; [Write, Description("This rule prevents scripts from launching potentially malicious downloaded content."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent; [Write, Description("This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockOfficeApplicationsFromCreatingExecutableContent; [Write, Description("This rule blocks code injection attempts from Office apps into other processes."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockOfficeApplicationsFromInjectingCodeIntoOtherProcesses; [Write, Description("This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockOfficeCommunicationAppFromCreatingChildProcesses; [Write, Description("This rule prevents malware from abusing WMI to attain persistence on a device."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockPersistenceThroughWMIEventSubscription; [Write, Description("This rule blocks processes created through PsExec and WMI from running."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockProcessCreationsFromPSExecAndWMICommands; [Write, Description("With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockUntrustedUnsignedProcessesThatRunFromUSB; [Write, Description("This rule prevents VBA macros from calling Win32 APIs."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String BlockWin32APICallsFromOfficeMacros; [Write, Description("This rule provides an extra layer of protection against ransomware."), ValueMap{"off", "block","audit", "warn"}, Values{"off", "block","audit", "warn"}] String UseAdvancedProtectionAgainstRansomware; [Write, Description("List of additional folders that need to be protected")] String ControlledFolderAccessProtectedFolders[]; [Write, Description("List of apps that have access to protected folders.")] String ControlledFolderAccessAllowedApplications[]; [Write, Description("This rule enable Controlled folder access which protects your data by checking apps against a list of known, trusted apps.values 0:disable, 1:enable, 2:audit"), ValueMap{"0", "1","2"}, Values{"0", "1","2"}] String EnableControlledFolderAccess; [Write, Description("Present ensures the policy exists, absent ensures it is removed"), ValueMap{"Present","Absent"}, Values{"Present","Absent"}] string Ensure; [Write, Description("Credentials of the Intune Admin"), EmbeddedInstance("MSFT_Credential")] string Credential; [Write, Description("Id of the Azure Active Directory application to authenticate with.")] String ApplicationId; [Write, Description("Name of the Azure Active Directory tenant used for authentication. Format contoso.onmicrosoft.com")] String TenantId; [Write, Description("Secret of the Azure Active Directory tenant used for authentication.")] String ApplicationSecret; [Write, Description("Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.")] String CertificateThumbprint; }; |