What it does. 'Configures Windows Group Policy Objects to block ransomware execution Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-anti-ransomware-group-policy, or copy the skill folder into ~/.claude/skills/implementing-anti-ransomware-group-policy/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/implementing-anti-ransomware-group-policy/SKILL.md

SKILL.md (verbatim)

name: implementing-anti-ransomware-group-policy
description: 'Configures Windows Group Policy Objects to block ransomware execution
  and lateral spread, covering AppLocker rules, Software Restriction Policies, Controlled
  Folder Access, attack surface reduction rules, and network protection settings.
  Use when hardening Windows endpoints against ransomware via GPO, configuring AppLocker
  or Controlled Folder Access, or building endpoint protection policies through Group
  Policy.'
domain: cybersecurity
subdomain: ransomware-defense
tags:
- ransomware
- group-policy
- windows
- AppLocker
- hardening
- prevention
version: 1.0.0
author: mahipal
license: Apache-2.0
nist_csf:
- PR.DS-11
- RS.MA-01
- RC.RP-01
- PR.IR-01
mitre_attack:
- T1078
- T1190
- T1059
- T1486
- T1490
mitre_f3:
  version: '1.1'
  tactics:
  - initial-access
  - positioning
  - monetization
  techniques:
  - id: T1660
    name: Phishing
    tactic: initial-access
    source: attack
  - id: T1219
    name: Remote Access Tools
    tactic: positioning
    source: attack
  - id: T1531
    name: Account Access Removal
    tactic: positioning
    source: attack
  - id: F1018
    name: Convert to Cryptocurrency
    tactic: monetization
    source: f3

Implementing Anti-Ransomware Group Policy

When to Use

• Hardening a Windows Active Directory environment against ransomware execution and propagation
• Implementing defense-in-depth by blocking ransomware execution paths via Group Policy
• Configuring AppLocker or WDAC rules to prevent unauthorized executables from running in user-writable directories
• Enabling Controlled Folder Access to protect critical directories from unauthorized file modifications
• Restricting lateral movement vectors (RDP, SMB, WMI) that ransomware uses to spread across the domain

Do not use as a standalone ransomware defense. GPO settings complement but do not replace endpoint detection, backups, network segmentation, and user awareness training.

Prerequisites

• Windows Server 2016+ Active Directory environment with Group Policy Management Console (GPMC)
• Domain Admin or Group Policy Creator Owners privileges
• Windows 10/11 Enterprise or Education (required for AppLocker and WDAC)
• Microsoft Defender Antivirus enabled (required for Controlled Folder Access and ASR rules)
• Python 3.8+ for audit script that validates GPO compliance
• Test OU for validating GPO settings before domain-wide deployment

Workflow

Step 1: Block Ransomware Execution Paths with AppLocker

Configure AppLocker to prevent executables from running in common ransomware staging locations:

AppLocker GPO Path:
  Computer Configuration → Policies → Windows Settings →
  Security Settings → Application Control Policies → AppLocker

Key Rules:
━━━━━━━━━
1. DENY executable rules for user-writable paths:
   - %USERPROFILE%\AppData\Local\Temp\*     (email attachment extraction)
   - %USERPROFILE%\AppData\Roaming\*         (CryptoLocker staging)
   - %USERPROFILE%\Downloads\*               (web downloads)
   - %TEMP%\*                                (temporary extraction)
   - %USERPROFILE%\Desktop\*                 (social engineering drops)

2. ALLOW default rules:
   - C:\Windows\* (signed by Microsoft)
   - C:\Program Files\* and C:\Program Files (x86)\*
   - Administrator group: all paths

3. Enable Application Identity service:
   Computer Configuration → Policies → Windows Settings →
   Security Settings → System Services →
   Application Identity → Automatic

Step 2: Enable Controlled Folder Access

Protect critical directories from unauthorized modification:

Controlled Folder Access GPO Path:
  Computer Configuration → Administrative Templates →
  Windows Components → Microsoft Defender Antivirus →
  Microsoft Defender Exploit Guard → Controlled Folder Access

Settings:
━━━━━━━━━
1. Configure Controlled folder access: Enabled → Block mode
2. Configure protected folders: Add custom paths
   - \\fileserver\shares\finance
   - \\fileserver\shares\hr
   - C:\Users\*\Documents
   - C:\Users\*\Desktop

3. Configure allowed applications: Whitelist trusted apps
   - C:\Program Files\Microsoft Office\*
   - C:\Program Files\Adobe\*
   - Line-of-business applications

Default protected folders (automatic):
  Documents, Pictures, Videos, Music, Desktop, Favorites

Step 3: Configure Attack Surface Reduction (ASR) Rules

Enable ASR rules that target ransomware delivery mechanisms:

ASR Rules GPO Path:
  Computer Configuration → Administrative Templates →
  Windows Components → Microsoft Defender Antivirus →
  Microsoft Defender Exploit Guard → Attack Surface Reduction

Critical ASR Rules for Ransomware Prevention:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
GUID                                    Rule
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550   Block executable content from email
D4F940AB-401B-4EFC-AADC-AD5F3C50688A   Block Office apps from creating child processes
3B576869-A4EC-4529-8536-B80A7769E899   Block Office apps from creating executable content
75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84   Block Office apps from injecting into processes
D3E037E1-3EB8-44C8-A917-57927947596D   Block JavaScript/VBScript from launching downloads
5BEB7EFE-FD9A-4556-801D-275E5FFC04CC   Block execution of obfuscated scripts
92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B   Block Win32 API calls from Office macros
01443614-CD74-433A-B99E-2ECDC07BFC25   Block executable files unless they meet prevalence criteria

Set each rule to: Block (1) or Audit (2) for initial testing

Step 4: Restrict Lateral Movement Vectors

Lock down SMB, RDP, and WMI to limit ransomware propagation:

Network Restrictions:
━━━━━━━━━━━━━━━━━━━━
1. Disable SMBv1:
   Computer Configuration → Administrative Templates →
   Network → Lanman Workstation → Enable insecure guest logons: Disabled

   Computer Configuration → Administrative Templates →
   MS Security Guide → Configure SMBv1 server: Disabled

2. Restrict Remote Desktop:
   Computer Configuration → Administrative Templates →
   Windows Components → Remote Desktop Services →
   Remote Desktop Session Host → Connections →
   Allow users to connect remotely: Disabled (or restricted to specific groups)

3. Disable remote WMI:
   Windows Firewall → Inbound Rules →
   Block Windows Management Instrumentation (WMI) inbound

4. Disable AutoPlay/AutoRun:
   Computer Configuration → Administrative Templates →
   Windows Components → AutoPlay Policies →
   Turn off AutoPlay: Enabled (All drives)

5. Disable PowerShell remoting for non-admin users:
   Computer Configuration → Administrative Templates →
   Windows Components → Windows PowerShell →
   Turn on Script Execution: Allow only signed scripts

Step 5: Audit and Validate GPO Compliance

Verify that GPO settings are applied correctly across the domain:

# Check GPO application on endpoint
gpresult /r /scope:computer

# Verify AppLocker rules
Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

# Check Controlled Folder Access status
Get-MpPreference | Select-Object EnableControlledFolderAccess

# List protected folders
Get-MpPreference | Select-Object -ExpandProperty ControlledFolderAccessProtectedFolders

# Check ASR rules
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

Verification

• Run gpresult /r on test endpoints to confirm GPO application
• Attempt to run an executable from %AppData%\Temp to verify AppLocker blocks it
• Modify a file in a protected folder from an unlisted application to confirm CFA blocks it
• Test ASR rules by opening a macro-enabled document and verifying child process blocking
• Validate that legitimate applications in the allowlist still function correctly
• Check Windows Event Log for AppLocker events (Event IDs 8003, 8004) and CFA events (1123, 1124)

Key Concepts

Tools & Systems

• Group Policy Management Console (GPMC): Primary tool for creating and managing GPOs in Active Directory
• AppLocker: Built-in Windows application whitelisting and blacklisting engine
• Microsoft Defender Exploit Guard: Suite including CFA, ASR rules, and Network Protection
• GPResult: Command-line tool for verifying GPO application status on endpoints
• PowerShell Get-MpPreference: Cmdlet for querying Microsoft Defender configuration including ASR and CFA status

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference: Anti-Ransomware Group Policy

AppLocker PowerShell Cmdlets

Get Effective Policy

Get-AppLockerPolicy -Effective | Select-Object -ExpandProperty RuleCollections

Create AppLocker Rule

# Deny executables from AppData paths
New-AppLockerPolicy -RuleType Path -RuleNamePrefix "DenyAppData" `
  -Path "%USERPROFILE%\AppData\*" -Action Deny -User Everyone

Test AppLocker Policy

Test-AppLockerPolicy -Path "C:\Users\test\AppData\Local\Temp\malware.exe" `
  -XmlPolicy (Get-AppLockerPolicy -Effective -Xml)

AppLocker Event Log IDs

Controlled Folder Access (CFA)

Enable CFA

Set-MpPreference -EnableControlledFolderAccess Enabled

CFA Modes

Add Protected Folders

Add-MpPreference -ControlledFolderAccessProtectedFolders "C:\Finance"

Add Allowed Applications

Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\App\app.exe"

CFA Event IDs

Attack Surface Reduction (ASR) Rules

Enable ASR Rule

Add-MpPreference -AttackSurfaceReductionRules_Ids <GUID> `
  -AttackSurfaceReductionRules_Actions Enabled

ASR Rule Actions

Key Anti-Ransomware ASR Rule GUIDs

ASR Event IDs

GPO Paths Reference

AppLocker

Computer Configuration → Policies → Windows Settings →
Security Settings → Application Control Policies → AppLocker

Controlled Folder Access

Computer Configuration → Administrative Templates →
Windows Components → Microsoft Defender Antivirus →
Microsoft Defender Exploit Guard → Controlled Folder Access

Attack Surface Reduction

Computer Configuration → Administrative Templates →
Windows Components → Microsoft Defender Antivirus →
Microsoft Defender Exploit Guard → Attack Surface Reduction

Network Restrictions

Computer Configuration → Administrative Templates →
Network → Lanman Workstation    (SMB settings)
Windows Components → Remote Desktop Services    (RDP settings)
Windows Components → AutoPlay Policies    (AutoPlay/AutoRun)

GPResult Verification

# Check applied GPOs
gpresult /r /scope:computer

# Generate HTML report
gpresult /h gpo_report.html

# Check specific policy RSoP
gpresult /z /scope:computer

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.