Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/DeviceEnrichment.yaml [534:562]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Settings:
          Target: Defender
          Template: |-
            DeviceEvents
            | where tolower(ActionType) startswith "asr"
            | where TimeGenerated > ago(30d)
            | extend RuleName = case(
                ActionType == "AsrRuleBlockOfficeChildProcessCreation", "Block all Office applications from creating child processes",
                ActionType == "AsrRuleBlockOfficeExeContentExecution", "Block Office applications from creating executable content",
                ActionType == "AsrRuleBlockOfficeMacroChildProcesses", "Block Office applications from injecting code into other processes",
                ActionType == "AsrRuleBlockPersistenceThroughWmiEventSubscription", "Block persistence through WMI event subscription",
                ActionType == "AsrRuleBlockAdobeReaderChildProcess", "Block Adobe Reader from creating child processes",
                ActionType == "AsrRuleBlockObfuscatedScripts", "Block execution of potentially obfuscated scripts",
                ActionType == "AsrRuleBlockOfficeCommsChildProcess", "Block Office communication application from creating child processes",
                ActionType == "AsrRuleBlockWin32ApiCallsFromOfficeMacros", "Block Win32 API calls from Office macros",
                ActionType == "AsrRuleBlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem", "Block credential stealing from the Windows local security authority subsystem (lsass.exe)",
                ActionType == "AsrRuleBlockUntrustedUnsignedProcessThatRunFromUsb", "Block untrusted and unsigned processes that run from USB",
                ActionType == "AsrRuleBlockExecutableContentFromEmailClientAndWebmail", "Block executable content from email client and webmail",
                ActionType == "AsrRuleBlockExecutableFilesRunningUnlessMeetCriteria", "Block executable files from running unless they meet a prevalence, age, or trusted list criterion",
                ActionType == "AsrRuleBlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent", "Block JavaScript or VBScript from launching downloaded executable content",
                ActionType == "AsrRuleBlockExecutionOfPotentiallyObfuscatedScripts", "Block execution of potentially obfuscated scripts",
                ActionType == "AsrRuleUseAdvancedProtectionAgainstRansomware", "Use advanced protection against ransomware",
                ActionType == "AsrRuleBlockProcessCreationsFromPsexecAndWmiCommands", "Block process creations originating from PSExec and WMI commands",
                ActionType == "AsrRuleBlockRebootingMachineInSafeMode", "Block rebooting machine in Safe Mode (preview)",
                ActionType == "AsrRuleBlockAbuseOfExploitedVulnerableSignedDrivers", "Block abuse of exploited vulnerable signed drivers",
                ActionType == "AsrRuleBlockUseOfCopiedOrImpersonatedSystemTools", "Block use of copied or impersonated system tools (preview)",
                ActionType == "AsrRuleBlockWebshellCreationForServers", "Block Webshell creation for Servers",
                ActionType
            )
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



Plugins/Community Based Plugins/Microsoft Defender XDR Custom Plugin Scenarios/EnrichmentPlugins/DeviceEnrichment.yaml [589:617]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
        Settings:
          Target: Defender
          Template: |-
            DeviceEvents
            | where tolower(ActionType) startswith "asr"
            | where TimeGenerated > ago(30d)
            | extend RuleName = case(
                ActionType == "AsrRuleBlockOfficeChildProcessCreation", "Block all Office applications from creating child processes",
                ActionType == "AsrRuleBlockOfficeExeContentExecution", "Block Office applications from creating executable content",
                ActionType == "AsrRuleBlockOfficeMacroChildProcesses", "Block Office applications from injecting code into other processes",
                ActionType == "AsrRuleBlockPersistenceThroughWmiEventSubscription", "Block persistence through WMI event subscription",
                ActionType == "AsrRuleBlockAdobeReaderChildProcess", "Block Adobe Reader from creating child processes",
                ActionType == "AsrRuleBlockObfuscatedScripts", "Block execution of potentially obfuscated scripts",
                ActionType == "AsrRuleBlockOfficeCommsChildProcess", "Block Office communication application from creating child processes",
                ActionType == "AsrRuleBlockWin32ApiCallsFromOfficeMacros", "Block Win32 API calls from Office macros",
                ActionType == "AsrRuleBlockCredentialStealingFromWindowsLocalSecurityAuthoritySubsystem", "Block credential stealing from the Windows local security authority subsystem (lsass.exe)",
                ActionType == "AsrRuleBlockUntrustedUnsignedProcessThatRunFromUsb", "Block untrusted and unsigned processes that run from USB",
                ActionType == "AsrRuleBlockExecutableContentFromEmailClientAndWebmail", "Block executable content from email client and webmail",
                ActionType == "AsrRuleBlockExecutableFilesRunningUnlessMeetCriteria", "Block executable files from running unless they meet a prevalence, age, or trusted list criterion",
                ActionType == "AsrRuleBlockJavaScriptOrVBScriptFromLaunchingDownloadedExecutableContent", "Block JavaScript or VBScript from launching downloaded executable content",
                ActionType == "AsrRuleBlockExecutionOfPotentiallyObfuscatedScripts", "Block execution of potentially obfuscated scripts",
                ActionType == "AsrRuleUseAdvancedProtectionAgainstRansomware", "Use advanced protection against ransomware",
                ActionType == "AsrRuleBlockProcessCreationsFromPsexecAndWmiCommands", "Block process creations originating from PSExec and WMI commands",
                ActionType == "AsrRuleBlockRebootingMachineInSafeMode", "Block rebooting machine in Safe Mode (preview)",
                ActionType == "AsrRuleBlockAbuseOfExploitedVulnerableSignedDrivers", "Block abuse of exploited vulnerable signed drivers",
                ActionType == "AsrRuleBlockUseOfCopiedOrImpersonatedSystemTools", "Block use of copied or impersonated system tools (preview)",
                ActionType == "AsrRuleBlockWebshellCreationForServers", "Block Webshell creation for Servers",
                ActionType
            )
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



