DSCResources/MSFT_IntuneASRRulesPolicyWindows10/MSFT_IntuneASRRulesPolicyWindows10.schema.mof

[ClassVersion("1.0.0.0")]
class MSFT_DeviceManagementConfigurationPolicyAssignments
{
    [Write, Description("The type of the target assignment."), ValueMap{"#microsoft.graph.groupAssignmentTarget", "#microsoft.graph.allLicensedUsersAssignmentTarget", "#microsoft.graph.allDevicesAssignmentTarget", "#microsoft.graph.exclusionGroupAssignmentTarget", "#microsoft.graph.configurationManagerCollectionAssignmentTarget"}, Values{"#microsoft.graph.groupAssignmentTarget", "#microsoft.graph.allLicensedUsersAssignmentTarget", "#microsoft.graph.allDevicesAssignmentTarget", "#microsoft.graph.exclusionGroupAssignmentTarget", "#microsoft.graph.configurationManagerCollectionAssignmentTarget"}] String dataType;
    [Write, Description("The type of filter of the target assignment i.e. Exclude or Include. Possible values are:none, include, exclude."), ValueMap{"none", "include", "exclude"}, Values{"none", "include", "exclude"}] String deviceAndAppManagementAssignmentFilterType;
    [Write, Description("The Id of the filter for the target assignment.")] String deviceAndAppManagementAssignmentFilterId;
    [Write, Description("The group Id that is the target of the assignment.")] String groupId;
    [Write, Description("The collection Id that is the target of the assignment.(ConfigMgr)")] String collectionId;
};
 
[ClassVersion("1.0.0.0"), FriendlyName("IntuneASRRulesPolicyWindows10")]
class MSFT_IntuneASRRulesPolicyWindows10 : OMI_BaseResource
{
    [Key, Description("Identity of the endpoint protection attack surface protection rules policy for Windows 10.")] String Identity;
    [Required, Description("Display name of the endpoint protection attack surface protection rules policy for Windows 10.")] String DisplayName;
    [Write, Description("Description of the endpoint protection attack surface protection rules policy for Windows 10.")] String Description;
    [Write, Description("Assignments of the Intune Policy."), EmbeddedInstance("MSFT_DeviceManagementConfigurationPolicyAssignments")] String Assignments[];
    [Write, Description("This rule blocks processes created through PsExec and WMI from running."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String ProcessCreationType;
    [Write, Description("This rule provides an extra layer of protection against ransomware."), ValueMap{"notConfigured", "userDefined", "enable", "auditMode"}, Values{"notConfigured", "userDefined", "enable", "auditMode"}] String AdvancedRansomewareProtectionType;
    [Write, Description("This rule prevents malware from abusing WMI to attain persistence on a device."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String BlockPersistenceThroughWmiType;
    [Write, Description("This rule detects suspicious properties within an obfuscated script."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String ScriptObfuscatedMacroCodeType;
    [Write, Description("This rule prevents VBA macros from calling Win32 APIs."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String OfficeMacroCodeAllowWin32ImportsType;
    [Write, Description("This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String OfficeAppsLaunchChildProcessType;
    [Write, Description("This rule enable Controlled folder access which protects your data by checking apps against a list of known, trusted apps."), ValueMap{"notConfigured", "userDefined", "enable", "auditMode", "blockDiskModification", "auditDiskModification"}, Values{"notConfigured", "userDefined", "enable", "auditMode", "blockDiskModification", "auditDiskModification"}] String GuardMyFoldersType;
    [Write, Description("With this rule, admins can prevent unsigned or untrusted executable files from running from USB removable drives, including SD cards."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String UntrustedUSBProcessType;
    [Write, Description("Exclude files and paths from attack surface reduction rules")] String AttackSurfaceReductionExcludedPaths[];
    [Write, Description("This rule blocks executable files that don't meet a prevalence, age, or trusted list criteria, such as .exe, .dll, or .scr, from launching."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String UntrustedExecutableType;
    [Write, Description("This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions."), ValueMap{"notConfigured", "userDefined", "enable", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "enable", "auditMode", "warn", "disable"}] String OfficeCommunicationAppsLaunchChildProcess;
    [Write, Description("This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String EmailContentExecutionType;
    [Write, Description("This rule prevents scripts from launching potentially malicious downloaded content."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String ScriptDownloadedPayloadExecutionType;
    [Write, Description("List of additional folders that need to be protected")] String AdditionalGuardedFolders[];
    [Write, Description("This rule prevents attacks by blocking Adobe Reader from creating processes."), ValueMap{"notConfigured", "userDefined", "enable", "auditMode", "warn"}, Values{"notConfigured", "userDefined", "enable", "auditMode", "warn"}] String AdobeReaderLaunchChildProcess;
    [Write, Description("This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String OfficeAppsExecutableContentCreationOrLaunchType;
    [Write, Description("This rule helps prevent credential stealing by locking down Local Security Authority Subsystem Service (LSASS)."), ValueMap{"notConfigured", "userDefined", "enable", "auditMode", "warn"}, Values{"notConfigured", "userDefined", "enable", "auditMode", "warn"}] String PreventCredentialStealingType;
    [Write, Description("This rule blocks code injection attempts from Office apps into other processes."), ValueMap{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}, Values{"notConfigured", "userDefined", "block", "auditMode", "warn", "disable"}] String OfficeAppsOtherProcessInjectionType;
    [Write, Description("List of apps that have access to protected folders.")] String GuardedFoldersAllowedAppPaths[];
    [Write, Description("Present ensures the site collection exists, absent ensures it is removed"), ValueMap{"Present", "Absent"}, Values{"Present", "Absent"}] string Ensure;
    [Write, Description("Credentials of the Intune Admin"), EmbeddedInstance("MSFT_Credential")] string Credential;
    [Write, Description("Id of the Azure Active Directory application to authenticate with.")] String ApplicationId;
    [Write, Description("Name of the Azure Active Directory tenant used for authentication. Format contoso.onmicrosoft.com")] String TenantId;
    [Write, Description("Secret of the Azure Active Directory tenant used for authentication."), EmbeddedInstance("MSFT_Credential")] String ApplicationSecret;
    [Write, Description("Thumbprint of the Azure Active Directory application's authentication certificate to use for authentication.")] String CertificateThumbprint;
    [Write, Description("Managed ID being used for authentication.")] Boolean ManagedIdentity;
};