Question
Your company uses line-of-business apps that contain Microsoft Office VBA macros.
You need to prevent users from downloading and running additional payloads from the Office VBA macros as additional child processes.
Which two commands can you run to achieve the goal? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.
- A. Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled Correct
- B. Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions AuditMode
- C. Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions AuditMode
- D. Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions Enabled Correct
Explanation
GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A is the attack surface reduction rule Block all Office applications from creating child processes, which stops macros from launching further payloads as child processes. To actually prevent the behavior the rule must be set to Enabled (block mode), and both Set-MpPreference and Add-MpPreference can configure it, so A and D each work. AuditMode only logs what the rule would have blocked and lets the child process run, so B and C do not meet the goal.
