Attack Surface Reduction یا به اصطلاح ASR رول ها میکند.
از ویژگی های این ابزار به میتوان به موارد زیر اشاره کرد:
Local and Remote Query Support: Seamlessly query Windows Defender settings on both local and remote machines.
User-Context: Operates efficiently from a low-user context, eliminating the need for administrative permissions.
Windows Defender Exclusions: Retrieve and list all exclusion paths configured in Windows Defender.
Attack Surface Reduction (ASR) Rules: Enumerate ASR rules, displaying both the IDs and their corresponding names for easy identification.
Triggered ASR Events: Extract and list all triggered ASR events to monitor system security activities.
Detailed Output: Presents information in a clear, tabulated format for easy reading and analysis.
Getting ASR rules from MSFT_MpPreference class, it is under the following namespace root\Microsoft\Windows\Defender. and you don't need admin privileges.
Works from low user context .
Supports local & remote queries
Extracts paths from Event ID 5007 and ASR from Event ID 1121 using regex
Enumerates ASR rules from MSFT_MpPreference WMI class(works perfectly from low user context as well).
Displays results in a clean, tabulated format
works smoothly with inline-assembly
#RedTeam #BlueTeam #Evasion
@securation