L1 BIO 12.04.01 CIS Windows - Firewall public logging

Intune: Windows Firewall Public - Log Dropped Packets

📅 2025-10-30
•
⏱️ 2 minuten lezen
•
🟢 Should-Have

💼 Management Samenvatting

Log dropped packets in Public profile - **CRITICAL** attack visibility on public WiFi (airport, hotel networks = hostile).

Aanbeveling
IMPLEMENT
Risico zonder
Medium
Risk Score
6/10
Implementatie
3u (tech: 1u)
Van toepassing op:
✓ Windows 10
✓ Windows 11

Public WiFi dropped packets = attack detection: Public network: Attackers on same WiFi (airport, hotel), Attack attempts: Port scans (attacker scans your laptop 445/SMB, 3389/RDP), exploit attempts, Dropped packet logs: Evidence of attacks (attacker IP, ports scanned, timestamps), Incident response: 'Was I attacked on hotel WiFi?' → check firewall logs → YES (100+ port scan attempts from 10.5.1.99). SIEM: Forward logs → automated alerts ('Port scan detected on public WiFi').

PowerShell Modules Vereist
Primary API: Microsoft Graph API
Connection: Connect-MgGraph
Required Modules: Microsoft.Graph.DeviceManagement

Implementatie

Log public dropped: Policy: Log dropped packets: Yes, Log: Attack attempts blocked by firewall, Critical: Laptops (travel users - public WiFi exposure), Export: To SIEM (Log Analytics) → alerts, forensics.

Vereisten

  1. Intune subscription
  2. Windows 10/11
  3. Laptops (priority)
  4. Log size: 16MB+
  5. SIEM: Log Analytics

Implementatie

Intune Settings Catalog: Windows Firewall → Public Profile → Log dropped packets: Yes. Laptops: CRITICAL (public WiFi exposure). Export: Log Analytics → SIEM alerts.

Compliance

CIS Windows Benchmark L1, BIO 12.04.

Monitoring

Gebruik PowerShell-script enable-public-network-firewall-enable-log-dropped-packets-is-set-to-yes-enable-logging-of-dropped-packets.ps1 (functie Invoke-Monitoring) – Controleren.

Remediatie

Gebruik PowerShell-script enable-public-network-firewall-enable-log-dropped-packets-is-set-to-yes-enable-logging-of-dropped-packets.ps1 (functie Invoke-Remediation) – Herstellen.

Compliance & Frameworks

Automation

Gebruik het onderstaande PowerShell script om deze security control te monitoren en te implementeren. Het script bevat functies voor zowel monitoring (-Monitoring) als remediation (-Remediation).

PowerShell
<# .SYNOPSIS Intune Windows Firewall: Public Log Dropped .DESCRIPTION CIS - Public dropped packets logging. .NOTES Filename: firewall-public-log-dropped.ps1|Author: Nederlandse Baseline voor Veilige Cloud|NetSH: Public LogBlocked|Expected: True #> #Requires -Version 5.1 #Requires -RunAsAdministrator [CmdletBinding()]param([switch]$WhatIf, [switch]$Monitoring, [switch]$Remediation, [switch]$Revert) $ErrorActionPreference = 'Stop'; $Profile = "Public"; $ExpectedValue = $true function Connect-RequiredServices { $p = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent()); return $p.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator) } function Test-Compliance { $r = [PSCustomObject]@{ScriptName = "firewall-public-log-dropped.ps1"; PolicyName = "Firewall Public Log Dropped"; IsCompliant = $false; CurrentValue = $null; ExpectedValue = "Enabled"; Details = @() }; function Invoke-Revert { Set-NetFirewallProfile -Name $Profile -LogBlocked False } try { $fw = Get-NetFirewallProfile -Name $Profile -ErrorAction SilentlyContinue; if ($fw) { $r.CurrentValue = $fw.LogBlocked; if ($fw.LogBlocked -eq $ExpectedValue) { $r.IsCompliant = $true; $r.Details += "Dropped logging enabled" }else { $r.Details += "Dropped logging: $($fw.LogBlocked)" } }else { $r.Details += "Profile niet gevonden" } }catch { $r.Details += "Error: $($_.Exception.Message)" }; return $r } function Invoke-Remediation { Set-NetFirewallProfile -Name $Profile -LogBlocked True; Write-Host "Public dropped logging enabled" -ForegroundColor Green } function Invoke-Monitoring { $r = Test-Compliance; Write-Host "`n$($r.PolicyName): $(if($r.IsCompliant){'COMPLIANT'}else{'NON-COMPLIANT'})" -ForegroundColor $(if ($r.IsCompliant) { 'Green' }else { 'Red' }); return $r } function Invoke-Revert { Set-NetFirewallProfile -Name $Profile -LogBlocked False } try { if (-not(Connect-RequiredServices)) { exit 1 }; if ($Monitoring) { $r = Invoke-Monitoring; exit $(if ($r.IsCompliant) { 0 }else { 1 }) }elseif ($Remediation) { if (-not $WhatIf) { Invoke-Remediation } }elseif ($Revert) { Invoke-Revert }else { $r = Test-Compliance; exit $(if ($r.IsCompliant) { 0 }else { 1 }) } }catch { Write-Error $_; exit 1 }

Risico zonder implementatie

Risico zonder implementatie
Medium: Medium: No public WiFi logging = blind to attacks (laptops on hostile networks).

Management Samenvatting

Log Public firewall dropped packets. Public WiFi attack detection. Laptops priority. Export to SIEM. Implementatie: 1-3 uur.