LudusMCP Server

# Schema for ludus_enable_asr Role # Enables Windows Defender Attack Surface Reduction rules name: curi0usjack.ludus_enable_asr type: role version: "1.0.0" description: "Enables 16 Windows Defender Attack Surface Reduction (ASR) rules to harden endpoint security" repository: "https://github.com/curi0usJack/Ludus-MDE-MDI-Roles/tree/main/ludus_enable_asr" author: "curi0usJack (@curi0usJack)" installation_method: "ludus ansible role add -d /path/to/directory" note: "This role requires Windows hosts with Windows Defender available. No variables required - all ASR rules are enabled automatically." warning: "ASR rules may impact legitimate applications. Test in non-production environments first." # This role has no configurable variables - it automatically enables all 16 ASR rules variables: {} # ASR Rules enabled by this role: # - Block Office Child Process Creation (D4F940AB-401B-4EFC-AADC-AD5F3C50688A) # - Block Process Injection (75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84) # - Block Win32 API calls in macros (92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B) # - Block Office from creating executables (3B576869-A4EC-4529-8536-B80A7769E899) # - Block execution of potentially obfuscated scripts (5BEB7EFE-FD9A-4556-801D-275E5FFC04CC) # - Block executable content from email client and webmail (BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550) # - Block JavaScript or VBScript from launching downloaded executable content (D3E037E1-3EB8-44C8-A917-57927947596D) # - Block lsass cred theft (9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2) # - Block untrusted and unsigned processes that run from USB (b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4) # - Block Adobe Reader from creating child processes (7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c) # - Block persistence through WMI event subscription (e6db77e5-3df2-4cf1-b95a-636979351e5b) # - Block process creations originating from PSExec and WMI commands (d1e49aac-8f56-4280-b9ba-993a6d77406c) # - Block unsigned driver abuse (56a863a9-875e-4185-98a7-b882c64b5ce5) # - Block executable files from running unless they meet a prevalence, age, or trusted list criterion (01443614-cd74-433a-b99e-2ecdc07bfc25) # - Block use of copied or impersonated system tools (c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb) # - Use advanced protection against ransomware (c1db55ab-c21a-4637-bb3f-a12568109d35)