Configurando Configurações Avançadas do Windows Defender

Quando Usar

Use esta habilidade quando:

• Configurar o Microsoft Defender for Endpoint (MDE) além das configurações padrão para proteção aprimorada
• Implementar regras de Redução de Superfície de Ataque (ASR) para bloquear técnicas de ataque comuns
• Habilitar o acesso controlado a pastas para proteção contra ransomware
• Configurar recursos de proteção de rede e proteção contra explorações
• Implantar configurações do Defender via Intune, SCCM ou Política de Grupo em escala empresarial

Não use esta habilidade para implantação de EDR de terceiros (CrowdStrike, SentinelOne) ou para o Microsoft Defender for Cloud (proteção de cargas de trabalho do Azure).

Pré-requisitos

• Windows 10/11 Enterprise com Microsoft Defender Antivírus habilitado
• Licença Microsoft 365 E5 ou Microsoft Defender for Endpoint Plano 2 (para recursos completos do MDE)
• Microsoft Intune ou SCCM para implantação de políticas empresariais
• Acesso ao portal Microsoft 365 Defender (security.microsoft.com)
• Endpoints não executando AV de terceiros em modo ativo (o Defender entra em modo passivo)

Fluxo de Trabalho

Etapa 1: Configurar Regras de Redução de Superfície de Ataque (ASR)

As regras ASR bloqueiam comportamentos específicos comumente usados por malware e atacantes:

# Enable ASR rules via PowerShell (or deploy via Intune/GPO)
# Mode: 0=Disabled, 1=Block, 2=Audit, 6=Warn

# Block executable content from email client and webmail
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
  -AttackSurfaceReductionRules_Actions 1

# Block all Office applications from creating child processes
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
  -AttackSurfaceReductionRules_Actions 1

# Block Office applications from creating executable content
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 `
  -AttackSurfaceReductionRules_Actions 1

# Block Office applications from injecting code into other processes
Set-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
  -AttackSurfaceReductionRules_Actions 1

# Block JavaScript or VBScript from launching downloaded executable content
Set-MpPreference -AttackSurfaceReductionRules_Ids D3E037E1-3EB8-44C8-A917-57927947596D `
  -AttackSurfaceReductionRules_Actions 1

# Block execution of potentially obfuscated scripts
Set-MpPreference -AttackSurfaceReductionRules_Ids 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC `
  -AttackSurfaceReductionRules_Actions 1

# Block Win32 API calls from Office macros
Set-MpPreference -AttackSurfaceReductionRules_Ids 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B `
  -AttackSurfaceReductionRules_Actions 1

# Block credential stealing from Windows LSASS
Set-MpPreference -AttackSurfaceReductionRules_Ids 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 `
  -AttackSurfaceReductionRules_Actions 1

# Block process creations from PSExec and WMI commands
Set-MpPreference -AttackSurfaceReductionRules_Ids D1E49AAC-8F56-4280-B9BA-993A6D77406C `
  -AttackSurfaceReductionRules_Actions 1

# Block untrusted and unsigned processes from USB
Set-MpPreference -AttackSurfaceReductionRules_Ids B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4 `
  -AttackSurfaceReductionRules_Actions 1

# Block persistence through WMI event subscription
Set-MpPreference -AttackSurfaceReductionRules_Ids E6DB77E5-3DF2-4CF1-B95A-636979351E5B `
  -AttackSurfaceReductionRules_Actions 1

# Block abuse of exploited vulnerable signed drivers
Set-MpPreference -AttackSurfaceReductionRules_Ids 56A863A9-875E-4185-98A7-B882C64B5CE5 `
  -AttackSurfaceReductionRules_Actions 1

Etapa 2: Configurar Acesso Controlado a Pastas (Proteção contra Ransomware)

# Enable Controlled Folder Access
Set-MpPreference -EnableControlledFolderAccess Enabled

# Default protected folders: Documents, Pictures, Videos, Music, Desktop, Favorites
# Add custom protected folders
Add-MpPreference -ControlledFolderAccessProtectedFolders "C:\CriticalData"
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\SharedDrives"

# Allow specific applications to access protected folders
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\CustomApp\app.exe"
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\Backup\backup.exe"

# Set to Audit mode first to identify legitimate applications that need access
Set-MpPreference -EnableControlledFolderAccess AuditMode
# Event ID 1124 in Microsoft-Windows-Windows Defender/Operational log

Etapa 3: Configurar Proteção de Rede

…