SecOps - 41050 - Attack surface reduction (ASR) rules are enabled in block mode

[Naga Praneeth Chukka (praneeth-0000)]

No description provided.

[Copilot]

Pull request overview

This PR introduces a new SecOps assessment (41050) that evaluates whether Microsoft Defender Attack Surface Reduction (ASR) Secure Score controls are fully scored (interpreted as “block mode enabled”) by correlating pinned Secure Score control profiles (scid_2500–scid_2518) with the latest Secure Score snapshot.

Changes:

• Adds Test-Assessment-41050 PowerShell test that queries Secure Score control profiles + latest snapshot and renders a per-control results table.
• Adds accompanying markdown content for the assessment with remediation links and a %TestResult% placeholder.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/powershell/tests/Test-Assessment.41050.ps1	New assessment test implementation using Graph Secure Score endpoints and markdown report generation.
src/powershell/tests/Test-Assessment.41050.md	New assessment documentation and remediation links with results placeholder.

Suppressed comments (2)

src/powershell/tests/Test-Assessment.41050.ps1:197

• Overall pass/fail logic only checks for any Fail vs any Pass. If some controls are Investigate (e.g., missing profile/score/non-numeric), the test can still return Pass, and if all controls are N/A it falls into Investigate. Consider handling Investigate separately and treating an all-N/A evaluation as NotApplicable.

    if ($failedItems.Count -gt 0) {
        $testResultMarkdown = "❌ One or more attack surface reduction rules are in audit / disabled mode (below their target score).`n`n%TestResult%"
    }
    elseif ($passedItems.Count -gt 0) {
        $passed = $true

src/powershell/tests/Test-Assessment.41050.ps1:252

• When the evaluation yields only N/A rows (no applicable devices), the test currently returns a normal result with Status = $false and an investigate-style message. To match other device-scope checks, emit -SkippedBecause NotApplicable in this case.

    $params = @{
        TestId = '41050'
        Title  = 'Attack surface reduction (ASR) rules are enabled in block mode'
        Status = $passed
        Result = $testResultMarkdown

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (2)

src/powershell/tests/Test-Assessment.41050.ps1:198

• A partial profile response or a non-numeric score creates an Investigate row, but this branch still marks the assessment as passed whenever any other row passes. That can emit “all applicable rules” even though one of the 19 pinned controls could not be evaluated. Only pass when no Investigate rows remain (while retaining the existing fail-first precedence).

    elseif ($passedItems.Count -gt 0) {
        $passed = $true
        $testResultMarkdown = "✅ All applicable attack surface reduction rules are deployed in block mode.`n`n%TestResult%"

src/powershell/tests/Test-Assessment.41050.ps1:20

• This new assessment has no focused Pester coverage, although the analogous Secure Score assessment has a test at code-tests/test-assessments/Test-Assessment.41060.Tests.ps1. Add tests for all-pass, below-max failure, ignored/N/A controls, partial or malformed Graph data, authorization errors, and other query failures so the aggregate status and skip/investigate contracts are verified.

function Test-Assessment-41050 {

[Aleksandar Nikolić (alexandair)]

Naga Praneeth Chukka (@praneeth-0000) Please, address my feedback.

[Aleksandar Nikolić (alexandair)]

LGTM