Skip to content

Instantly share code, notes, and snippets.

@alexverboon

alexverboon/CI_AsrPersistenceThroughWmi_Remediation.ps1

Created October 29, 2020 21:40
Show Gist options
  • Save alexverboon/2c9bf111f1c4841908a70b612638dc49 to your computer and use it in GitHub Desktop.
Save alexverboon/2c9bf111f1c4841908a70b612638dc49 to your computer and use it in GitHub Desktop.
Download ZIP
CI_AsrPersistenceThroughWmi_Remediation.ps1
Raw
CI_AsrPersistenceThroughWmi_Remediation.ps1
<#
.Synopsis
CI_AsrPersistenceThroughWmi_Remediation
.DESCRIPTION
Script for Configuration Manager - Configuration Item
CI_AsrPersistenceThroughWmi_Remediation configures the Rule Block persistence through WMI event subscription in Block mode
.NOTES
v1.0, 28.10.2020, alex verboon
#>
Write-Output "Configuring Block persistence through WMI event subscription in Block mode"
$AsrPersistenceThroughWmiRuleID = "e6db77e5-3df2-4cf1-b95a-636979351e5b"
Add-MpPreference -AttackSurfaceReductionRules_Ids "$AsrPersistenceThroughWmiRuleID" -AttackSurfaceReductionRules_Actions Enabled
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment