SecOps - 41050 - Attack surface reduction (ASR) rules are enabled in block mode

[Naga Praneeth Chukka (praneeth-0000)]

No description provided.

[Copilot]

Pull request overview

This PR introduces a new SecOps assessment (41050) that evaluates whether Microsoft Defender Attack Surface Reduction (ASR) Secure Score controls are fully scored (interpreted as “block mode enabled”) by correlating pinned Secure Score control profiles (scid_2500–scid_2518) with the latest Secure Score snapshot.

Changes:

• Adds Test-Assessment-41050 PowerShell test that queries Secure Score control profiles + latest snapshot and renders a per-control results table.
• Adds accompanying markdown content for the assessment with remediation links and a %TestResult% placeholder.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/powershell/tests/Test-Assessment.41050.ps1	New assessment test implementation using Graph Secure Score endpoints and markdown report generation.
src/powershell/tests/Test-Assessment.41050.md	New assessment documentation and remediation links with results placeholder.

Suppressed comments (2)

src/powershell/tests/Test-Assessment.41050.ps1:197

• Overall pass/fail logic only checks for any Fail vs any Pass. If some controls are Investigate (e.g., missing profile/score/non-numeric), the test can still return Pass, and if all controls are N/A it falls into Investigate. Consider handling Investigate separately and treating an all-N/A evaluation as NotApplicable.

    if ($failedItems.Count -gt 0) {
        $testResultMarkdown = "❌ One or more attack surface reduction rules are in audit / disabled mode (below their target score).`n`n%TestResult%"
    }
    elseif ($passedItems.Count -gt 0) {
        $passed = $true

src/powershell/tests/Test-Assessment.41050.ps1:252

• When the evaluation yields only N/A rows (no applicable devices), the test currently returns a normal result with Status = $false and an investigate-style message. To match other device-scope checks, emit -SkippedBecause NotApplicable in this case.

    $params = @{
        TestId = '41050'
        Title  = 'Attack surface reduction (ASR) rules are enabled in block mode'
        Status = $passed
        Result = $testResultMarkdown

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/powershell/tests/Test-Assessment.41050.ps1:198

• A partial profile response or a non-numeric score creates an Investigate row, but this branch still marks the assessment as passed whenever any other row passes. That can emit “all applicable rules” even though one of the 19 pinned controls could not be evaluated. Only pass when no Investigate rows remain (while retaining the existing fail-first precedence).

    elseif ($passedItems.Count -gt 0) {
        $passed = $true
        $testResultMarkdown = "✅ All applicable attack surface reduction rules are deployed in block mode.`n`n%TestResult%"

src/powershell/tests/Test-Assessment.41050.ps1:20

• This new assessment has no focused Pester coverage, although the analogous Secure Score assessment has a test at code-tests/test-assessments/Test-Assessment.41060.Tests.ps1. Add tests for all-pass, below-max failure, ignored/N/A controls, partial or malformed Graph data, authorization errors, and other query failures so the aggregate status and skip/investigate contracts are verified.

function Test-Assessment-41050 {

[Aleksandar Nikolić (alexandair)]

Naga Praneeth Chukka (@praneeth-0000) Please, address my feedback.

[Aleksandar Nikolić (alexandair)]

Authorization failures are incorrectly reported as Not Applicable

if ((Get-ZtHttpStatusCode -ErrorRecord $queryError) -in (401, 403)) {
    Add-ZtTestResultDetail -SkippedBecause NotApplicable ...
    return
}

A 401/403 proves that the assessment could not read the tenant configuration. It does not prove that ASR is inapplicable.

This also contradicts the 41050 specification’s Investigate message:

ASR Secure Score data was not found; verify SecurityEvents.Read.All is granted...

The result will be suppressed as an applicability skip instead of surfacing the missing permission for investigation. The neighboring Secure Score implementation for 41060 also reports 401/403 through CustomStatus = 'Investigate'.

Required change: return an Investigate result for 401/403, preserving the permission-specific explanation. Reserve NotApplicable for evidence that the service or feature genuinely does not apply.