Protecting Windows Devices Against Malicious Software Installers with Microsoft Intune

-

 



Background – Understanding the Threat

Microsoft Security Research has identified a campaign involving trojanized installers distributed through unofficial download websites.

Users are encouraged to download cracked software, game cheats, activation tools and free utilities. However, these installers may contain additional unwanted or malicious components that execute without the user's knowledge.

The consequences can include unwanted software installations, misuse of device resources, proxy services running in the background and potential compromise of organizational devices.

This is not simply an antivirus issue. It also highlights the importance of application control, least-privilege access and endpoint monitoring.

The objective of this guide is to demonstrate how organizations can use Microsoft Intune and Microsoft Defender to reduce the risk of these threats.


Step 1 – Enable Potentially Unwanted Application (PUA) Protection

Priority: High

Why does this matter?

Potentially Unwanted Applications (PUAs) include software that may display unwanted advertisements, bundle additional applications or perform other unwanted activities.

Microsoft recommends enabling PUA protection to help detect and block these applications.

Configure in Microsoft Intune

  1. Open the Microsoft Intune admin center.

  2. Navigate to Endpoint security → Antivirus.

  3. Create or edit a Windows antivirus policy.

  4. Locate PUA Protection.

  5. Configure the setting to block detected applications.



Recommended configuration:

  • PUA Protection: Enabled

  • Action: Detected items are blocked

Expected result: Microsoft Defender Antivirus blocks detected PUA applications and can quarantine them.

Operational consideration: Test the configuration with a pilot group first. Some legitimate utilities may be incorrectly classified, so IT should review detections before approving exceptions.

Step 2 – Enable Cloud-Delivered Protection and Tamper Protection

Priority: High

Why does this matter?

Traditional signature-based detection may not be sufficient against new and evolving threats.

Cloud-delivered protection helps Microsoft Defender identify emerging threats using Microsoft's cloud-based threat intelligence.

Tamper Protection helps prevent unauthorized changes to important Defender security settings.

Configure in Microsoft Intune

Navigate to:

Endpoint security → Antivirus

Create or edit a Windows antivirus policy.

Review the following settings:

  • Cloud-delivered protection: Enabled

  • Tamper Protection: Enabled


Expected result: Devices receive improved threat detection capabilities while important security configurations are protected against unauthorized changes.

Step 3 – Enable Microsoft Defender SmartScreen

Why does this matter?

Users may be tricked into downloading malicious installers from websites that appear legitimate.

Microsoft Defender SmartScreen helps protect users by checking the reputation of websites and downloaded files.

Configure in Microsoft Intune

Use the Settings Catalog to configure the relevant Windows and Microsoft Edge settings.

Review the following configurations:

  • Microsoft Defender SmartScreen: Enabled

  • Prevent bypassing Microsoft Defender SmartScreen warnings: Enabled

Also ensure that SmartScreen protection is enabled for Microsoft Edge.

Expected result: Users receive additional protection against malicious websites and suspicious downloads.

Operational consideration: Communicate to users that SmartScreen warnings are intentional security controls and should not be ignored.

Step 4 – Implement Attack Surface Reduction (ASR) Rules

Priority: High

Why does this matter?

Attack Surface Reduction (ASR) rules help prevent common behaviors used by malicious software to compromise Windows devices.

One particularly relevant rule blocks executable files unless they meet specific prevalence, age or trusted-list criteria.

Configure in Microsoft Intune

  1. Navigate to Endpoint security → Attack Surface Reduction.

  2. Create a Windows policy.

  3. Select the Attack Surface Reduction Rules profile.

  4. Configure the relevant rules.

  5. Recommended rules

    Block executable files from running unless they meet a prevalence, age, or trusted list criterion

    • Recommended setting: Audit → Block
    • Helps prevent unknown or low-reputation executable files from running. 

    Block all Office applications from creating child processes

    • Recommended setting: Audit → Block
    • Helps prevent malware from using Word, Excel or PowerPoint to launch PowerShell, Command Prompt or other processes.

    Block Office applications from creating executable content

    • Recommended setting: Audit → Block
    • Prevents Office applications from creating executable files that could later be used by malware. 

    Block executable content from email client and webmail

    • Recommended setting: Block
    • Helps stop malicious executable attachments delivered through email. 

    Block JavaScript or VBScript from launching downloaded executable content

    • Recommended setting: Block
    • Reduces the risk of script-based malware downloaded from the internet.

    Block credential stealing from the Windows Local Security Authority Subsystem (LSASS)

    • Recommended setting: Audit → Block
    • Helps protect user credentials from theft by malware and post-compromise tools. 

Recommended deployment approach:

1. Start with Audit Mode.
2. Review audit events and application compatibility.
3. Move validated rules to Block Mode.
4. Continue monitoring through Microsoft Defender for Endpoint.
Expected result:
Fewer unknown and suspicious executable files are allowed to run.
Operational consideration:

Review audit events and identify potential application compatibility issues before enabling blocking.

Step 5 – Monitor Devices with Microsoft Defender for Endpoint

Why does this matter?

Preventive security controls are important, but organizations must also be able to identify threats that manage to bypass them.

Microsoft recommends investigating suspicious installations, unexpected processes and persistence mechanisms.

Configure in Microsoft Intune

  1. Navigate to Endpoint security → Microsoft Defender for Endpoint.

  2. Verify that the connection between Intune and Defender for Endpoint is configured.

  3. Ensure Windows devices are onboarded.

  4. Open the Microsoft Defender portal.

  5. Navigate to Assets → Devices to review onboarded devices.

Pay particular attention to:

  • Unexpected software installations.

  • Executables launched from temporary directories.

  • Unusual scheduled tasks.

  • Suspicious processes and network connections.

Expected result: IT administrators gain better visibility into endpoint activity and can investigate suspicious behavior before it develops into a larger incident.

Additional Security Recommendations

Beyond the measures described above, organizations should consider additional controls to strengthen their endpoint security posture.

Remove local administrator rights
Prevent standard users from making unauthorized system changes.

Windows LAPS
Securely manage and rotate local administrator passwords.

App Control for Business
Restrict which applications are allowed to run.

Conditional Access
Control access based on identity and device security status.

Note: These controls complement the recommendations described in this guide but are not direct requirements from the Microsoft threat report.



Recommended Implementation Order

For organizations planning to introduce these controls, I recommend the following implementation order:

  1. PUA Protection: Block potentially unwanted applications.

  2. Cloud Protection and Tamper Protection: Strengthen Microsoft Defender.

  3. SmartScreen: Protect against malicious websites and downloads.

  4. Attack Surface Reduction: Restrict suspicious execution behaviors.

  5. Defender for Endpoint: Monitor devices and investigate suspicious activities.

Important: Always test policies with a limited pilot group before deploying them across the organization. Review security events, application compatibility and potential false positives.

Conclusion

There is no single Intune policy that can prevent every type of malicious installation.

Effective endpoint protection requires multiple security layers working together. Microsoft Defender, Intune, application control and user awareness all play important roles.

By combining preventive security controls, restricted user privileges and continuous endpoint monitoring, organizations can significantly reduce the risk of malicious software gaining a foothold in their Windows environments.


Kommentarer

Skicka en kommentar

Populära inlägg i den här bloggen

🔵Troubleshooting Intune Device Enrollments: Understanding GUIDs, Registry Paths, and EnterpriseMgmt Tasks

-
Bild
This guide explains how to diagnose Intune MDM issues on a Windows device by using two key locations: Task Scheduler → EnterpriseMgmt Registry → HKLM\SOFTWARE\Microsoft\Enrollments These two locations always contain matching GUID folders , and together they show the full state of the device’s MDM enrollment. 📌 Introduction: Why do these GUID folders exist? When a Windows device enrolls into Intune (MDM) , Windows generates a unique GUID folder for that enrollment. That GUID is used in two places: 🔹 1. Task Scheduler Task Scheduler → Microsoft → Windows → EnterpriseMgmt → {GUID} This folder contains scheduled jobs that handle: MDM sync certificate renewal policy retrieval push notification handling 🔹 2. Registry HKLM\SOFTWARE\Microsoft\Enrollments\{GUID} This folder contains detailed information: tenant ID enrollment type certificate thumbprints renewal status MDM server URLs device identity 👉 Both folders describe the same en...
Read more »

Windows Autopilot – Hardware Hash (HWID) Extraction with Group Tag

-
📌 Description This PowerShell script is used to extract the Windows Autopilot hardware hash (HWID) from a device and save it as a CSV file directly to a USB drive . Each file is created with a unique filename based on device model, serial number, and timestamp. During execution, you are prompted to enter a Group Tag . The Group Tag is written directly into the CSV file and is later used by Windows Autopilot to automatically assign the device to the correct device groups, deployment profiles, and Microsoft Intune policies. This approach is commonly used when manually collecting hardware hashes instead of paying a hardware vendor to unpack devices and pre-register them in Autopilot. By extracting the HWID in-house (for example during OOBE) and saving it to USB, organizations can reduce costs , keep full control , and still ensure devices are fully prepared for automated deployment.   🚀 Features Extracts Windows Autopilot hardware hash (HWID) Automatically adds a...
Read more »

Automating Network Printer Deployment with Microsoft Intune, PowerShell and PrintBRM

-
Bild
Deploy Local IP Printers with Microsoft Intune and PowerShell Automating Network Printer Deployment with Microsoft Intune, PowerShell and PrintBRM A practical approach to packaging, deploying and detecting network printers on Windows 11 devices Deploying printers to Windows 11 devices managed by Microsoft Intune can be challenging, especially when the devices are Microsoft Entra joined and not joined to a traditional Active Directory domain. This is a common scenario for Windows kiosk devices, where the device is managed entirely through Intune but still needs access to an organization's printers. Two Common Approaches 1. Microsoft Universal Print Universal Print provides a cloud-based printing solution where printers can be managed and assigned through Microsoft 365 and Intune. This can be a good option for organizations that want to move their printing infrastructure to the cloud. 2. Intune + PowerShell If you already have network printers t...
Read more »