implementing-anti-ransomware-group-policy

实施反勒索软件组策略

何时使用

• 强化 Windows Active Directory 环境，防御勒索软件的运行与传播
• 通过组策略阻断勒索软件的执行路径，实施纵深防御
• 配置 AppLocker 或 WDAC 规则，阻止未经授权的可执行文件在用户可写目录中运行
• 启用受控文件夹访问，保护关键目录免受未经授权的文件修改
• 限制勒索软件用于在域内横向扩散的横向移动途径（RDP、SMB、WMI）

请勿将其作为独立的勒索软件防御手段。GPO 设置是对端点检测、备份、网络分段和用户意识培训的补充，而非替代。

前提条件

• Windows Server 2016+ Active Directory 环境，并安装了组策略管理控制台（GPMC）
• 具有 Domain Admin 或 Group Policy Creator Owners 权限
• Windows 10/11 企业版或教育版（AppLocker 和 WDAC 所必需）
• 已启用 Microsoft Defender Antivirus（受控文件夹访问和 ASR 规则所必需）
• Python 3.8+，用于验证 GPO 合规性的审计脚本
• 用于在全域部署前验证 GPO 设置的测试 OU

工作流

步骤 1：使用 AppLocker 阻断勒索软件执行路径

配置 AppLocker，阻止可执行文件在常见的勒索软件暂存位置运行：

AppLocker GPO Path:
  Computer Configuration → Policies → Windows Settings →
  Security Settings → Application Control Policies → AppLocker

Key Rules:
━━━━━━━━━
1. DENY executable rules for user-writable paths:
   - %USERPROFILE%\AppData\Local\Temp\*     (email attachment extraction)
   - %USERPROFILE%\AppData\Roaming\*         (CryptoLocker staging)
   - %USERPROFILE%\Downloads\*               (web downloads)
   - %TEMP%\*                                (temporary extraction)
   - %USERPROFILE%\Desktop\*                 (social engineering drops)

2. ALLOW default rules:
   - C:\Windows\* (signed by Microsoft)
   - C:\Program Files\* and C:\Program Files (x86)\*
   - Administrator group: all paths

3. Enable Application Identity service:
   Computer Configuration → Policies → Windows Settings →
   Security Settings → System Services →
   Application Identity → Automatic

步骤 2：启用受控文件夹访问

保护关键目录免受未经授权的修改：

Controlled Folder Access GPO Path:
  Computer Configuration → Administrative Templates →
  Windows Components → Microsoft Defender Antivirus →
  Microsoft Defender Exploit Guard → Controlled Folder Access

Settings:
━━━━━━━━━
1. Configure Controlled folder access: Enabled → Block mode
2. Configure protected folders: Add custom paths
   - \\fileserver\shares\finance
   - \\fileserver\shares\hr
   - C:\Users\*\Documents
   - C:\Users\*\Desktop

3. Configure allowed applications: Whitelist trusted apps
   - C:\Program Files\Microsoft Office\*
   - C:\Program Files\Adobe\*
   - Line-of-business applications

Default protected folders (automatic):
  Documents, Pictures, Videos, Music, Desktop, Favorites

步骤 3：配置攻击面减少（ASR）规则

启用针对勒索软件投递机制的 ASR 规则：

ASR Rules GPO Path:
  Computer Configuration → Administrative Templates →
  Windows Components → Microsoft Defender Antivirus →
  Microsoft Defender Exploit Guard → Attack Surface Reduction

Critical ASR Rules for Ransomware Prevention:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
GUID                                    Rule
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550   Block executable content from email
D4F940AB-401B-4EFC-AADC-AD5F3C50688A   Block Office apps from creating child processes
3B576869-A4EC-4529-8536-B80A7769E899   Block Office apps from creating executable content
75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84   Block Office apps from injecting into processes
D3E037E1-3EB8-44C8-A917-57927947596D   Block JavaScript/VBScript from launching downloads
5BEB7EFE-FD9A-4556-801D-275E5FFC04CC   Block execution of obfuscated scripts
92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B   Block Win32 API calls from Office macros
01443614-CD74-433A-B99E-2ECDC07BFC25   Block executable files unless they meet prevalence criteria

Set each rule to: Block (1) or Audit (2) for initial testing

步骤 4：限制横向移动途径

锁定 SMB、RDP 和 WMI，以限制勒索软件的传播：

Network Restrictions:
━━━━━━━━━━━━━━━━━━━━
1. Disable SMBv1:
   Computer Configuration → Administrative Templates →
   Network → Lanman Workstation → Enable insecure guest logons: Disabled

   Computer Configuration → Administrative Templates →
   MS Security Guide → Configure SMBv1 server: Disabled

2. Restrict Remote Desktop:
   Computer Configuration → Administrative Templates →
   Windows Components → Remote Desktop Services →
   Remote Desktop Session Host → Connections →
   Allow users to connect remotely: Disabled (or restricted to specific groups)

3. Disable remote WMI:
   Windows Firewall → Inbound Rules →
   Block Windows Management Instrumentation (WMI) inbound

4. Disable AutoPlay/AutoRun:
   Computer Configuration → Administrative Templates →
   Windows Components → AutoPlay Policies →
   Turn off AutoPlay: Enabled (All drives)

5. Disable PowerShell remoting for non-admin users:
   Computer Configuration → Administrative Templates →
   Windows Components → Windows PowerShell →
   Turn on Script Execution: Allow only signed scripts

步骤 5：审计并验证 GPO 合规性

验证 GPO 设置已在域内正确应用：

# Check GPO application on endpoint
gpresult /r /scope:computer

# Verify AppLocker rules
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

# Check Controlled Folder Access status
Get-MpPreference | Select-Object EnableControlledFolderAccess

# List protected folders
Get-MpPreference | Select-Object -ExpandProperty ControlledFolderAccessProtectedFolders

# Check ASR rules
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

验证

• 在测试端点上运行 gpresult /r，确认 GPO 已应用
• 尝试从 %AppData%\Temp 运行可执行文件，验证 AppLocker 会将其阻止
• 从未列入名单的应用程序中修改受保护文件夹内的文件，确认 CFA 会将其阻止
• 通过打开启用宏的文档并验证子进程被阻止，来测试 ASR 规则
• 验证允许列表中的合法应用程序仍能正常工作
• 检查 Windows 事件日志中的 AppLocker 事件（事件 ID 8003、8004）和 CFA 事件（1123、1124）

关键概念

术语	定义
AppLocker	Windows 应用程序控制功能，根据发布者、路径或哈希规则限制用户可以运行哪些可执行文件、脚本和 DLL
受控文件夹访问	Microsoft Defender 功能，阻止不受信任的应用程序修改受保护目录中的文件
攻击面减少（ASR）	Microsoft Defender Exploit Guard 中的一组规则，用于阻止特定攻击行为，例如 Office 宏子进程
软件限制策略（SRP）	用于限制可执行文件的旧版 Windows 功能（在 Win 11 中已弃用）；已被 AppLocker 和 WDAC 取代
WDAC	Windows Defender Application Control；AppLocker 的后继者，通过代码完整性策略实现更强制的执行

工具与系统

• 组策略管理控制台（GPMC）：在 Active Directory 中创建和管理 GPO 的主要工具
• AppLocker：Windows 内置的应用程序允许列表和阻止列表引擎
• Microsoft Defender Exploit Guard：包含 CFA、ASR 规则和网络保护的套件
• GPResult：用于验证端点上 GPO 应用状态的命令行工具
• PowerShell Get-MpPreference：用于查询 Microsoft Defender 配置（包括 ASR 和 CFA 状态）的 cmdlet