Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
CI_AsrPersistenceThroughWmi_Remediation.ps1
<#
.Synopsis
CI_AsrPersistenceThroughWmi_Remediation
.DESCRIPTION
Script for Configuration Manager - Configuration Item
CI_AsrPersistenceThroughWmi_Remediation configures the Rule Block persistence through WMI event subscription in Block mode
.NOTES
v1.0, 28.10.2020, alex verboon
#>
Write-Output "Configuring Block persistence through WMI event subscription in Block mode"
$AsrPersistenceThroughWmiRuleID = "e6db77e5-3df2-4cf1-b95a-636979351e5b"
Add-MpPreference -AttackSurfaceReductionRules_Ids "$AsrPersistenceThroughWmiRuleID" -AttackSurfaceReductionRules_Actions Enabled
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment