Endpoint Security
Microsoft Intune + Attack Surface Reduction (ASR). All changes are applied through Intune - never the Windows registry.
8
Managed devices
7
Compliant
1
Non-compliant
14
Compliance policies
88%
Enrollment
Attack Surface Reduction (ASR)
95% enabled
17 Block
3 Warn
1 Disabled
How it works: ASR rules are configured through Microsoft Intune endpoint security policies. ProPera Online
never modifies the Windows registry - if a change would require a registry edit, it is denied and escalated to an
Administrator or Global Administrator.
| Rule | MITRE | State | Coverage | Source | Action |
|---|---|---|---|---|---|
|
Block execution of potentially obfuscated scripts
01443614-e7cf-4acb-b74c-4d7e6a9b6b7e
|
T1027 Defense Evasion | Enabled · Block |
63%
|
Intune | |
|
Block Office applications from creating executable content
3b576869-a4ec-4529-8536-b80a7769e899
|
T1204 Execution | Enabled · Warn |
77%
|
Intune | |
|
Block Office applications from injecting code into other processes
75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84
|
T1055 Defense Evasion | Enabled · Block |
68%
|
Intune | |
|
Block Office communication application from creating child processes
26190899-1602-49e8-8b27-eb1d0a1ce869
|
T1059 Execution | Enabled · Block |
96%
|
Intune | |
|
Block Adobe Reader from creating child processes
7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
T1204 Execution | Enabled · Block |
89%
|
Intune | |
|
Block credential stealing from the Windows local security authority subsystem (lsass.exe)
9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
T1003 Credential Access | Enabled · Block |
67%
|
Intune | |
|
Block untrusted and unsigned processes that run from USB
b2b3f03d-6a14-4eb2-aa82-1b9222d4bcd9
|
T1200 Initial Access | Enabled · Block |
94%
|
Intune | |
|
Block persistence through Windows management instrumentation (WMI) event subscription
d4f6ab3e-4c0b-4d6d-8a2d-4f9d1b9f1f3a
|
T1546 Persistence | Enabled · Block |
97%
|
Intune | |
|
Block process creations originating from PSExec and WMI commands
92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b
|
T1021 Lateral Movement | Enabled · Block |
96%
|
Intune | |
|
Block JavaScript or VBScript from launching downloaded executable content
5beb7efe-fd9a-4556-801d-275e5ffc04cc
|
T1204 Execution | Enabled · Block |
90%
|
Intune | |
|
Block executable content from email client and webmail
d3e037e1-3eb8-44c8-a917-5794974752f1
|
T1566 Initial Access | Enabled · Block |
62%
|
Intune | |
|
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
3b576869-a4ec-4529-8536-b80a7769e899
|
T1204 Execution | Enabled · Warn |
72%
|
Intune | |
|
Use advanced protection against ransomware
c1db55ab-c21a-4637-bb3f-a12568109d35
|
T1486 Impact | Enabled · Block |
83%
|
Intune | |
|
Block Win32 API calls from Office macros
9b93497a-2b85-4a48-9ef7-9b2f7f3f6b3d
|
T1059 Defense Evasion | Enabled · Block |
75%
|
Intune | |
|
Block abuse of exploited vulnerable signed drivers
c0033c00-d16d-411a-86b3-df4c5d0b1d1a
|
T1068 Privilege Escalation | Disabled |
83%
|
Intune | |
|
Block Office applications from creating executable content (Outlook)
a8f5898e-1dc8-49a0-9f5e-1b8e2b0c4d3e
|
T1204 Execution | Enabled · Block |
86%
|
Intune | |
|
Block process creations from PSExec and WMI (per-rule)
be9ba2d9-53ea-4cdc-84e5-9b1eeee46550
|
T1021 Lateral Movement | Enabled · Block |
84%
|
Intune | |
|
Block executable files from running unless they meet a prevalence, age, or trusted list criterion
d1e49aac-8f56-4280-b9ba-993a6d77406c
|
T1204 Execution | Enabled · Block |
64%
|
Intune | |
|
Block process creation from scripts (script interpreter protection)
33d6699c-7f2f-4f0e-a4d4-8b3b5f1c2a6e
|
T1059 Execution | Enabled · Warn |
96%
|
Intune | |
|
Block untrusted executable content from removable media
b26b6023-5b4d-4e0f-9b7d-8c1a2e3f4d5a
|
T1200 Initial Access | Enabled · Block |
86%
|
Intune | |
|
Block execution of potentially obfuscated scripts (JS/VBS)
e6db77e5-3df2-4cf1-b95a-636979351e5b
|
T1027 Defense Evasion | Enabled · Block |
80%
|
Intune |
Intune managed devices
| Device | OS | Compliance | Risk | Health | Last seen |
|---|---|---|---|---|---|
| corp-dc01 | WindowsServer2022 | Compliant | Medium | Healthy | 2026-08-18 |
| corp-srv-app02 | WindowsServer2019 | Compliant | High | Healthy | 2026-08-18 |
| corp-srv-file01 | WindowsServer2019 | Compliant | Medium | Healthy | 2026-08-18 |
| corp-wks-1187 | Windows11 | Compliant | High | Healthy | 2026-08-18 |
| corp-wks-0421 | Windows10 | Compliant | Medium | Healthy | 2026-08-18 |
| corp-wks-0913 | Windows11 | Compliant | Low | Healthy | 2026-08-18 |
| corp-lap-2210 | Windows10 | Non-compliant | Medium | Warning | 2026-08-18 |
| corp-lap-3345 | Windows11 | Compliant | Low | Healthy | 2026-08-18 |
