Windows-itpro-docs: Unable to find "block persistence through wmi event subscription"

[SteffanH]

The Microsoft Defender Security Center Threat & Vulnerability Management security recommendations refer to "Block persistence through WMI event subscription" as an action to be taken to reduce the attack surface.

Creating an Attack Surface Reduction profile via the Microsoft Endpoint Manager admin center does not show "Block persistence through WMI event subscription" as a configuration option.

The only WMI related option is "Block process creations originating from PSExec and WMI commands"?

---

Document details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 5d747289-63b2-f71a-b40c-31b52982215c
• Version Independent ID: b52f6593-03f2-aa57-ec0e-eaef560dcaf0
• Content: Use attack surface reduction rules to prevent malware infection - Windows security
• Content Source: windows/security/threat-protection/microsoft-defender-atp/attack-surface-reduction.md
• Product: w10
• Technology: windows
• GitHub Login: @denisebmsft
• Microsoft Alias: deniseb

[MVDB1984]

Same here....

[kimoppalfens]

And here

[MaratMussabekov]

Dear @SteffanH ,
the option "block persistence through wmi event subscription" is not available (or not available yet) in Intune. I created a PR to fix this in the article.
You can enable this rule using PowerShell or GPO.
Thank you

[SteffanH]

@MaratMussabekov , where can I find documentation how to enable this via PowerShell?

[MaratMussabekov]

Hello @SteffanH ,
please see this article.
Thank you

[jaimeo]

Not sure why this was assigned to me? It's not an area I know anything about and isn't my article.

[e0i]

@jaimeo Apologies for the mistake from my end. The issue should in fact be closed as it has been answered by Marat. Thank you.

[DarrenBennett]

You can simply use a custom Configuration Profile in Intune with the CSP GUID for the ASR rule.

OMA-URI: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules
Data type: String
Value: {e6db77e5-3df2-4cf1-b95a-636979351e5b}=1

[ivassallo19]

This shouldn't be closed.
The policy is still not available via Endpoint Manager.
And I personally don't want to write up an entire ASR Rule into a String to use for a Policy CSP.

[wbach82]

When will this ARS rule be possible to set via Endpoint Manager?

[illfated]

When will this ARS rule be possible to set via Endpoint Manager?

That looks like a question for the Microsoft developers. To reach them, you should post your question in the Feedback App or Feedback feature within your OS.
Also, if I may add some practical information, just for the sake of keeping you informed:

Wish I could help, but this repository is not intended for regular support issues, support requests or support questions.

You may want to look elsewhere for answers, unless you have suggestions for improving one or more specific pages in the MS Docs repository.

Disclaimer: I am not affiliated with Microsoft or the Microsoft Docs teams here on GitHub.

The intention of this repository is to improve on the existing documentation by providing the users a way to report factual errors, improvement suggestions and request updates for new versions.

The MS Docs team members might not have time to answer your question, both due to the small size of the team and the big workload.

Try the following resources to get in touch with users who may be able to help you:

• TechNet forums: https://social.technet.microsoft.com/Forums/en-US/home
• MSDN: https://social.msdn.microsoft.com/Forums/en-US/home
• Microsoft Community: https://answers.microsoft.com/