34 lines
1.1 KiB
JSON
34 lines
1.1 KiB
JSON
[
|
|
{
|
|
"id": "AC-01-AppLocker",
|
|
"title": "AppLocker policy present",
|
|
"strategy": "AC",
|
|
"type": "scriptblock",
|
|
"script": "try { (Get-AppLockerPolicy -Effective).RuleCollections.Count -gt 0 } catch { $false }",
|
|
"minLevel": "ML1"
|
|
},
|
|
{
|
|
"id": "AC-AppLocker-Enforced",
|
|
"title": "AppLocker enforcement not AuditOnly for at least one collection",
|
|
"strategy": "AC",
|
|
"type": "scriptblock",
|
|
"script": "(Get-AppLockerPolicy -Effective -ErrorAction SilentlyContinue).RuleCollections | Where-Object { $_.EnforcementMode -and $_.EnforcementMode -ne 'AuditOnly' } | Measure-Object | ForEach-Object { $_.Count -gt 0 }",
|
|
"minLevel": "ML1"
|
|
},
|
|
{
|
|
"id": "AC-02-WDAC",
|
|
"title": "WDAC policy key present",
|
|
"strategy": "AC",
|
|
"type": "scriptblock",
|
|
"script": "Test-Path 'HKLM:\\SYSTEM\\CurrentControlSet\\Control\\CI\\Policy'",
|
|
"minLevel": "ML1"
|
|
},
|
|
{
|
|
"id": "AC-03-SRP",
|
|
"title": "Software Restriction Policies present",
|
|
"strategy": "AC",
|
|
"type": "scriptblock",
|
|
"script": "Test-Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers'",
|
|
"minLevel": "ML1"
|
|
}
|
|
] |