Controlled folder access (CFA) demonstrations (block ransomware)

Стаття
10/11/2024

Applies to:

Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Microsoft Defender Antivirus assesses all apps (any executable file, including .exe, .scr, .dll files and others) and then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then the app can't make changes to any files in any protected folder.

Scenario requirements and setup

Windows 10 1709 build 16273
Microsoft Defender Antivirus (active mode)

PowerShell commands

Set-MpPreference -EnableControlledFolderAccess (State)

Set-MpPreference -ControlledFolderAccessProtectedFolders C:\demo\

Rule states

State	Mode	Numeric value
Disabled	Off	0
Enabled	Block mode	1
Audit	Audit mode	2

Verify configuration

Get-MpPreference

Test file

CFA ransomware test file

Scenarios

Setup

Download and run this setup script. Before running the script, set execution policy to Unrestricted by using this PowerShell command:

Set-ExecutionPolicy Unrestricted

Or, you can perform these manual steps instead:

Create a folder under c: named demo, as in c:\demo.
Save this clean file into c:\demo (we need something to encrypt).
Run the PowerShell commands listed earlier in this article.

Next, check that status of the Aggressive Ransomware Prevention ASR rule and disable it for the duration of this test if it's enabled:

$idx = $(Get-MpPreference).AttackSurfaceReductionRules_Ids.IndexOf("C1DB55AB-C21A-4637-BB3F-A12568109D35")
if ($idx -ge 0) {Write-Host "Rule Status: " $(Get-MpPreference).AttackSurfaceReductionRules_Actions[$idx]} else {Write-Host "Rule does not exist on this machine"}

If the rule exists and the status is 1 (Enabled) or 6 (Warn), it must be disabled to run this test:

Add-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 -AttackSurfaceReductionRules_Actions Disabled

Scenario 1: CFA blocks ransomware test file

Turn on CFA using PowerShell command:

Set-MpPreference -EnableControlledFolderAccess Enabled

Add the demo folder to protected folders list using PowerShell command:
```
Set-MpPreference -ControlledFolderAccessProtectedFolders C:\demo\
```
Download the ransomware test file.
Execute the ransomware test file. Note that it isn't ransomware; it simply tries to encrypt c:\demo.

Scenario 1 expected results

About five seconds after executing the ransomware test file, you should see a notification that CFA blocked the encryption attempt.

Scenario 2: What would happen without CFA

Turn off CFA using this PowerShell command:

Set-MpPreference -EnableControlledFolderAccess Disabled

Execute the ransomware test file.

Scenario 2 expected results

The files in c:\demo are encrypted and you should get a warning message
Execute the ransomware test file again to decrypt the files

Clean-up

Download and run this cleanup script. You can perform these manual steps instead:
```
Set-MpPreference -EnableControlledFolderAccess Disabled
```
Clean up c:\demo encryption by using the encrypt/decrypt file

If the Aggressive Ransomware Prevention ASR rule was enabled and you disabled it at the beginning of this test, enable it again:

Add-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 -AttackSurfaceReductionRules_Actions Enabled

Поділитися через