CI_AsrPersistenceThroughWmi_Remediation.ps1
| <# | |
| .Synopsis | |
| CI_AsrPersistenceThroughWmi_Remediation | |
| .DESCRIPTION | |
| Script for Configuration Manager - Configuration Item | |
| CI_AsrPersistenceThroughWmi_Remediation configures the Rule Block persistence through WMI event subscription in Block mode | |
| .NOTES | |
| v1.0, 28.10.2020, alex verboon | |
| #> | |
| Write-Output "Configuring Block persistence through WMI event subscription in Block mode" | |
| $AsrPersistenceThroughWmiRuleID = "e6db77e5-3df2-4cf1-b95a-636979351e5b" | |
| Add-MpPreference -AttackSurfaceReductionRules_Ids "$AsrPersistenceThroughWmiRuleID" -AttackSurfaceReductionRules_Actions Enabled | |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment