Skip to content

Commit 733da22

Browse files
KelvinTegelaarKelvinTegelaar
committed
updated
1 parent 08d2bcb commit 733da22

41 files changed

Lines changed: 1362 additions & 2 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ function Push-CIPPTestsList {
3131

3232
# Emit one task per suite — suite names must match the ValidateSet in Invoke-CIPPTestCollection.
3333
# Function discovery happens inside Invoke-CIPPTestCollection via Get-Command (path-independent).
34-
$Suites = @('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'CopilotReadiness', 'GenericTests', 'Custom')
34+
$Suites = @('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'SMB1001', 'CopilotReadiness', 'GenericTests', 'Custom')
3535

3636
$Tasks = foreach ($Suite in $Suites) {
3737
[PSCustomObject]@{

‎Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ function Invoke-CIPPTestCollection {
1515
- EIDSCA → Invoke-CippTestEIDSCA*
1616
- CISA → Invoke-CippTestCISA*
1717
- CIS → Invoke-CippTestCIS_*
18+
- SMB1001 → Invoke-CippTestSMB1001_*
1819
- CopilotReadiness → Invoke-CippTestCopilotReady*
1920
- Custom → Special: enumerates enabled ScriptGuids from DB and calls
2021
Invoke-CippTestCustomScripts once per guid (the function
@@ -32,7 +33,7 @@ function Invoke-CIPPTestCollection {
3233
[CmdletBinding()]
3334
param(
3435
[Parameter(Mandatory = $true)]
35-
[ValidateSet('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'CopilotReadiness', 'GenericTests', 'Custom')]
36+
[ValidateSet('ZTNA', 'ORCA', 'EIDSCA', 'CISA', 'CIS', 'SMB1001', 'CopilotReadiness', 'GenericTests', 'Custom')]
3637
[string]$SuiteName,
3738

3839
[Parameter(Mandatory = $true)]
@@ -47,6 +48,7 @@ function Invoke-CIPPTestCollection {
4748
EIDSCA = 'Invoke-CippTestEIDSCA*'
4849
CISA = 'Invoke-CippTestCISA*'
4950
CIS = 'Invoke-CippTestCIS_*'
51+
SMB1001 = 'Invoke-CippTestSMB1001_*'
5052
CopilotReadiness = 'Invoke-CippTestCopilotReady*'
5153
GenericTests = 'Invoke-CippTestGenericTest*'
5254
}

‎Modules/CIPPTests/Public/Tests/SMB1001/Devices/Invoke-CippTestSMB1001_1_10.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
SMB1001 (1.10) — Level 5 — disable untrusted Microsoft Office macros. The Intune-managed implementation is Defender Attack Surface Reduction (ASR) rules. The two key rules for SMB1001 1.10 are:
2+
3+
- **Block Win32 API calls from Office macros** — prevents macros from calling Win32 APIs to download/execute payloads.
4+
- **Block all Office applications from creating child processes** — prevents Office from spawning malicious processes.
5+
6+
**Remediation Action**
7+
8+
1. Intune admin centre > Endpoint security > Attack surface reduction > Create policy.
9+
2. Choose Windows > Attack Surface Reduction Rules.
10+
3. Set both Office-macro rules to **Block** (or Audit while validating).
11+
4. Assign to All Devices or a target group.
12+
13+
**Links**
14+
- [SMB1001:2026 Standard](https://dsi.org)
15+
- [Attack Surface Reduction rules reference](https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference)
16+
17+
<!--- Results --->
18+
%TestResult%

‎Modules/CIPPTests/Public/Tests/SMB1001/Devices/Invoke-CippTestSMB1001_1_10.ps1‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
function Invoke-CippTestSMB1001_1_10 {
2+
<#
3+
.SYNOPSIS
4+
Tests SMB1001 (1.10) - Disable untrusted Microsoft Office macros
5+
6+
.DESCRIPTION
7+
Verifies an Attack Surface Reduction (ASR) policy is deployed via Intune that blocks
8+
Win32 API calls from Office macros and child processes from Office apps. SMB1001 1.10
9+
(Level 5) requires untrusted Office macros to be disabled.
10+
#>
11+
param($Tenant)
12+
13+
try {
14+
$ConfigurationPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
15+
16+
if (-not $ConfigurationPolicies) {
17+
Add-CippTestResult -TenantFilter $Tenant -TestId 'SMB1001_1_10' -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing Intune licenses or data collection not yet completed.' -Risk 'High' -Name 'Untrusted Microsoft Office macros are disabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
18+
return
19+
}
20+
21+
$ASRPolicies = $ConfigurationPolicies | Where-Object {
22+
$_.platforms -like '*windows10*' -and
23+
$_.settings.settingInstance.settingDefinitionId -contains 'device_vendor_msft_policy_config_defender_attacksurfacereductionrules'
24+
}
25+
26+
if (-not $ASRPolicies -or $ASRPolicies.Count -eq 0) {
27+
Add-CippTestResult -TenantFilter $Tenant -TestId 'SMB1001_1_10' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No Attack Surface Reduction policies found. ASR rules block Office macro abuse, which SMB1001 1.10 requires.' -Risk 'High' -Name 'Untrusted Microsoft Office macros are disabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
28+
return
29+
}
30+
31+
$MacroProtected = $ASRPolicies | Where-Object {
32+
$children = $_.settings.settingInstance.groupSettingCollectionValue.children
33+
$win32MacroSetting = $children | Where-Object { $_.settingDefinitionId -eq 'device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockwin32apicallsfromofficemacros' }
34+
$officeChildSetting = $children | Where-Object { $_.settingDefinitionId -eq 'device_vendor_msft_policy_config_defender_attacksurfacereductionrules_blockallofficeapplicationsfromcreatingchildprocesses' }
35+
($win32MacroSetting.choiceSettingValue.value -like '*_block' -or $win32MacroSetting.choiceSettingValue.value -like '*_warn') -or
36+
($officeChildSetting.choiceSettingValue.value -like '*_block' -or $officeChildSetting.choiceSettingValue.value -like '*_warn')
37+
}
38+
39+
if (-not $MacroProtected -or $MacroProtected.Count -eq 0) {
40+
Add-CippTestResult -TenantFilter $Tenant -TestId 'SMB1001_1_10' -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'ASR policies exist but none enable the Office macro protection rules (Block Win32 API calls from Office macros / Block Office child processes).' -Risk 'High' -Name 'Untrusted Microsoft Office macros are disabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
41+
return
42+
}
43+
44+
$Assigned = $MacroProtected | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 }
45+
46+
if ($Assigned.Count -gt 0) {
47+
$Status = 'Passed'
48+
$Result = "$($Assigned.Count) ASR policy/policies are assigned with Office macro protection rules enabled."
49+
} else {
50+
$Status = 'Failed'
51+
$Result = "ASR policies with Office macro protection exist but are not assigned. Found $($MacroProtected.Count) unassigned policy/policies."
52+
}
53+
54+
Add-CippTestResult -TenantFilter $Tenant -TestId 'SMB1001_1_10' -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name 'Untrusted Microsoft Office macros are disabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
55+
} catch {
56+
$ErrorMessage = Get-CippException -Exception $_
57+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
58+
Add-CippTestResult -TenantFilter $Tenant -TestId 'SMB1001_1_10' -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name 'Untrusted Microsoft Office macros are disabled' -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
59+
}
60+
}

‎Modules/CIPPTests/Public/Tests/SMB1001/Devices/Invoke-CippTestSMB1001_1_12.md‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
SMB1001 (1.12) — Level 3 + Level 5 — implement Endpoint Detection and Response (EDR). At Level 5 the EDR must be paired with a Managed Detection and Response (MDR) service with a defined SLA. The Microsoft 365 implementation is Microsoft Defender for Endpoint, deployed via Intune onboarding plus an Endpoint security > EDR configuration policy.
2+
3+
The MDR contractual relationship is verified separately to a Dynamic Standard Certifier (it is an operational control, not a tenant config).
4+
5+
**Remediation Action**
6+
7+
1. Microsoft 365 Defender > Settings > Endpoints > Onboarding — generate the onboarding package.
8+
2. Intune admin centre > Endpoint security > Endpoint detection and response > Create policy.
9+
3. Choose "Auto-configure from MDE connector" so devices use the connector's configuration.
10+
4. Assign to All Devices.
11+
12+
Use CIPP `standards.IntuneTemplate` with an EDR template to deploy across tenants.
13+
14+
**Links**
15+
- [SMB1001:2026 Standard](https://dsi.org)
16+
- [Onboard devices to Defender for Endpoint with Intune](https://learn.microsoft.com/en-us/defender-endpoint/configure-endpoints-mdm)
17+
18+
<!--- Results --->
19+
%TestResult%

‎Modules/CIPPTests/Public/Tests/SMB1001/Devices/Invoke-CippTestSMB1001_1_12.ps1‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
function Invoke-CippTestSMB1001_1_12 {
2+
<#
3+
.SYNOPSIS
4+
Tests SMB1001 (1.12) - Implement Endpoint Detection and Response (EDR)
5+
6+
.DESCRIPTION
7+
Verifies the Microsoft Defender for Endpoint - Intune connector is enabled. The connector
8+
is the prerequisite for onboarding devices to MDE via Intune. SMB1001 1.12 Level 5
9+
additionally prescribes a Managed Detection and Response (MDR) service contract — that is
10+
a contractual control evidenced separately.
11+
#>
12+
param($Tenant)
13+
14+
$TestId = 'SMB1001_1_12'
15+
$Name = 'Endpoint Detection and Response (EDR) is deployed'
16+
17+
try {
18+
$MDEOnboarding = Get-CIPPTestData -TenantFilter $Tenant -Type 'MDEOnboarding'
19+
20+
if (-not $MDEOnboarding) {
21+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'MDEOnboarding cache not found. This may be due to missing Defender for Endpoint licenses or data collection not yet completed.' -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
22+
return
23+
}
24+
25+
$Connector = $MDEOnboarding | Select-Object -First 1
26+
$State = $Connector.partnerState
27+
28+
if ($State -eq 'enabled') {
29+
$Status = 'Passed'
30+
$Result = "The Microsoft Defender for Endpoint - Intune connector is enabled (partnerState: $State). Devices onboarded via Intune can report to MDE for EDR. If you are at L5, evidence the MDR service contract separately."
31+
} else {
32+
$Status = 'Failed'
33+
$Result = "The Microsoft Defender for Endpoint - Intune connector is not enabled (partnerState: $($State ?? 'unavailable')). Onboard tenant in Microsoft 365 Defender > Settings > Endpoints > Advanced features and connect Intune."
34+
}
35+
36+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
37+
} catch {
38+
$ErrorMessage = Get-CippException -Exception $_
39+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
40+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Medium' -Category 'Device'
41+
}
42+
}

‎Modules/CIPPTests/Public/Tests/SMB1001/Devices/Invoke-CippTestSMB1001_1_2.md‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
SMB1001 (1.2) — Level 1+ — install and configure a firewall on every device that connects to the Internet. The Intune-managed implementation is the Microsoft Defender Firewall configuration policy under Endpoint security > Firewall. This test passes when at least one firewall policy is assigned to a group.
2+
3+
**Remediation Action**
4+
5+
1. Intune admin centre > Endpoint security > Firewall > Create policy.
6+
2. Choose platform (Windows or macOS) and the Microsoft Defender Firewall profile.
7+
3. Configure rules and assign to All Devices or a target group.
8+
9+
Use CIPP `standards.IntuneTemplate` with a Defender Firewall template to deploy across tenants.
10+
11+
**Links**
12+
- [SMB1001:2026 Standard](https://dsi.org)
13+
- [Configure Microsoft Defender Firewall with Intune](https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-firewall-policy)
14+
15+
<!--- Results --->
16+
%TestResult%

‎Modules/CIPPTests/Public/Tests/SMB1001/Devices/Invoke-CippTestSMB1001_1_2.ps1‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
function Invoke-CippTestSMB1001_1_2 {
2+
<#
3+
.SYNOPSIS
4+
Tests SMB1001 (1.2) - Install and configure a firewall on all devices
5+
6+
.DESCRIPTION
7+
Verifies an Intune endpoint security firewall configuration policy exists and is assigned.
8+
SMB1001 1.2 requires firewalls on every device that connects to the Internet, including
9+
personal devices used for work.
10+
#>
11+
param($Tenant)
12+
13+
$TestId = 'SMB1001_1_2'
14+
$Name = 'Firewall is configured on all devices'
15+
16+
try {
17+
$ConfigurationPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
18+
19+
if (-not $ConfigurationPolicies) {
20+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing Intune licenses or data collection not yet completed.' -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
21+
return
22+
}
23+
24+
$FirewallPolicies = @($ConfigurationPolicies | Where-Object {
25+
$_.templateReference -and $_.templateReference.templateFamily -eq 'endpointSecurityFirewall'
26+
})
27+
28+
if ($FirewallPolicies.Count -eq 0) {
29+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No endpoint security firewall configuration policies found in Intune.' -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
30+
return
31+
}
32+
33+
$AssignedPolicies = @($FirewallPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
34+
35+
if ($AssignedPolicies.Count -gt 0) {
36+
$Status = 'Passed'
37+
$TableRows = foreach ($P in $FirewallPolicies) {
38+
$A = if ($P.assignments -and $P.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
39+
"| $($P.name) | $A |"
40+
}
41+
$Result = (@(
42+
"$($AssignedPolicies.Count) of $($FirewallPolicies.Count) firewall policy/policies are assigned."
43+
''
44+
'| Policy Name | Assigned |'
45+
'| :---------- | :------- |'
46+
) + $TableRows) -join "`n"
47+
} else {
48+
$Status = 'Failed'
49+
$Result = "Firewall policies exist but none are assigned. Found $($FirewallPolicies.Count) unassigned policy/policies."
50+
}
51+
52+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
53+
} catch {
54+
$ErrorMessage = Get-CippException -Exception $_
55+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
56+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
57+
}
58+
}

‎Modules/CIPPTests/Public/Tests/SMB1001/Devices/Invoke-CippTestSMB1001_1_3.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
SMB1001 (1.3) — Level 1+ — install and enable antivirus on every workstation and laptop. Mobile devices are covered by ensuring built-in protections (Google Play Protect, App Store) are active. The Intune-managed implementation is a Microsoft Defender Antivirus configuration policy under Endpoint security > Antivirus.
2+
3+
**Remediation Action**
4+
5+
1. Intune admin centre > Endpoint security > Antivirus > Create policy.
6+
2. Choose platform (Windows, macOS) and Microsoft Defender Antivirus profile.
7+
3. Configure real-time protection, cloud-delivered protection, automatic sample submission.
8+
4. Assign to All Devices or a target group.
9+
10+
**Links**
11+
- [SMB1001:2026 Standard](https://dsi.org)
12+
- [Antivirus policy for Endpoint security in Intune](https://learn.microsoft.com/en-us/intune/intune-service/protect/endpoint-security-antivirus-policy)
13+
14+
<!--- Results --->
15+
%TestResult%

‎Modules/CIPPTests/Public/Tests/SMB1001/Devices/Invoke-CippTestSMB1001_1_3.ps1‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
function Invoke-CippTestSMB1001_1_3 {
2+
<#
3+
.SYNOPSIS
4+
Tests SMB1001 (1.3) - Install antivirus software on all organization devices
5+
6+
.DESCRIPTION
7+
Verifies an Intune endpoint security antivirus configuration policy exists and is assigned.
8+
SMB1001 1.3 requires actively-updated antivirus on workstations and laptops.
9+
#>
10+
param($Tenant)
11+
12+
$TestId = 'SMB1001_1_3'
13+
$Name = 'Antivirus is installed and configured on all devices'
14+
15+
try {
16+
$ConfigurationPolicies = Get-CIPPTestData -TenantFilter $Tenant -Type 'IntuneConfigurationPolicies'
17+
18+
if (-not $ConfigurationPolicies) {
19+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Skipped' -ResultMarkdown 'No data found in database. This may be due to missing Intune licenses or data collection not yet completed.' -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
20+
return
21+
}
22+
23+
$AVPolicies = @($ConfigurationPolicies | Where-Object {
24+
$_.templateReference -and $_.templateReference.templateFamily -eq 'endpointSecurityAntivirus'
25+
})
26+
27+
if ($AVPolicies.Count -eq 0) {
28+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown 'No endpoint security antivirus configuration policies found in Intune.' -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
29+
return
30+
}
31+
32+
$AssignedPolicies = @($AVPolicies | Where-Object { $_.assignments -and $_.assignments.Count -gt 0 })
33+
34+
if ($AssignedPolicies.Count -gt 0) {
35+
$Status = 'Passed'
36+
$TableRows = foreach ($P in $AVPolicies) {
37+
$A = if ($P.assignments -and $P.assignments.Count -gt 0) { '✅ Yes' } else { '❌ No' }
38+
$Plat = if ($P.platforms) { $P.platforms } else { 'unknown' }
39+
"| $($P.name) | $Plat | $A |"
40+
}
41+
$Result = (@(
42+
"$($AssignedPolicies.Count) of $($AVPolicies.Count) antivirus policy/policies are assigned."
43+
''
44+
'| Policy Name | Platform | Assigned |'
45+
'| :---------- | :------- | :------- |'
46+
) + $TableRows) -join "`n"
47+
} else {
48+
$Status = 'Failed'
49+
$Result = "Antivirus policies exist but none are assigned. Found $($AVPolicies.Count) unassigned policy/policies."
50+
}
51+
52+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status $Status -ResultMarkdown $Result -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
53+
} catch {
54+
$ErrorMessage = Get-CippException -Exception $_
55+
Write-LogMessage -API 'Tests' -tenant $Tenant -message "Failed to run test: $($ErrorMessage.NormalizedError)" -sev Error -LogData $ErrorMessage
56+
Add-CippTestResult -TenantFilter $Tenant -TestId $TestId -TestType 'Devices' -Status 'Failed' -ResultMarkdown "Test failed: $($ErrorMessage.NormalizedError)" -Risk 'High' -Name $Name -UserImpact 'Low' -ImplementationEffort 'Low' -Category 'Device'
57+
}
58+
}

0 commit comments

Comments
 (0)