AutopilotMonitor/rules/guardrails.json

{
  "registryPrefixes": [
    {
      "category": "MDM / Enrollment",
      "prefixes": [
        "SOFTWARE\\Microsoft\\Enrollments",
        "SOFTWARE\\Microsoft\\EnterpriseDesktopAppManagement",
        "SOFTWARE\\Microsoft\\Provisioning",
        "SOFTWARE\\Microsoft\\PolicyManager",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\MDM"
      ]
    },
    {
      "category": "AAD / Entra Join",
      "prefixes": [
        "SOFTWARE\\Microsoft\\IdentityStore",
        "SYSTEM\\CurrentControlSet\\Control\\CloudDomainJoin"
      ]
    },
    {
      "category": "Windows Update / WUfB",
      "prefixes": [
        "SOFTWARE\\Microsoft\\WindowsUpdate",
        "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
      ]
    },
    {
      "category": "BitLocker",
      "prefixes": [
        "SOFTWARE\\Microsoft\\BitLocker",
        "SYSTEM\\CurrentControlSet\\Control\\BitLockerStatus"
      ]
    },
    {
      "category": "Network / Proxy",
      "prefixes": [
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings",
        "SYSTEM\\CurrentControlSet\\Services\\Tcpip"
      ]
    },
    {
      "category": "Autopilot / OOBE / Setup",
      "prefixes": [
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup",
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
        "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon",
        "SOFTWARE\\Microsoft\\Windows\\Autopilot"
      ]
    },
    {
      "category": "TPM",
      "prefixes": [
        "SYSTEM\\CurrentControlSet\\Services\\TPM",
        "SOFTWARE\\Microsoft\\Tpm"
      ]
    },
    {
      "category": "Secure Boot",
      "prefixes": [
        "SYSTEM\\CurrentControlSet\\Control\\SecureBoot"
      ]
    },
    {
      "category": "Intune IME",
      "prefixes": [
        "SOFTWARE\\Microsoft\\IntuneManagementExtension"
      ]
    },
    {
      "category": "Certificates (SCEP)",
      "prefixes": [
        "SOFTWARE\\Microsoft\\SystemCertificates",
        "SOFTWARE\\Policies\\Microsoft\\SystemCertificates"
      ]
    },
    {
      "category": "Servicing",
      "prefixes": [
        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Component Based Servicing"
      ]
    },
    {
      "category": "RealmJoin",
      "prefixes": [
        "SYSTEM\\CurrentControlSet\\Services\\realmjoin",
        "SOFTWARE\\RealmJoin"
      ]
    }
  ],
  "filePrefixes": [
    "C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
    "C:\\Windows\\CCM\\Logs",
    "C:\\Windows\\Logs",
    "C:\\Windows\\Panther",
    "C:\\Windows\\SetupDiag",
    "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log"
  ],
  "wmiQueryPrefixes": [
    "SELECT * FROM Win32_OperatingSystem",
    "SELECT * FROM Win32_ComputerSystem",
    "SELECT * FROM Win32_BIOS",
    "SELECT * FROM Win32_Processor",
    "SELECT * FROM Win32_BaseBoard",
    "SELECT * FROM Win32_Battery",
    "SELECT * FROM Win32_TPM",
    "SELECT * FROM Win32_NetworkAdapter",
    "SELECT * FROM Win32_NetworkAdapterConfiguration",
    "SELECT * FROM Win32_DiskDrive",
    "SELECT * FROM Win32_LogicalDisk",
    "SELECT * FROM SoftwareLicensingProduct"
  ],
  "eventLogChannels": [
    {
      "category": "Core Windows logs",
      "channels": [
        "Application",
        "System",
        "Setup",
        "Microsoft-Windows-Kernel-Boot",
        "Microsoft-Windows-Diagnostics-Performance"
      ]
    },
    {
      "category": "MDM / Enrollment",
      "channels": [
        "Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider",
        "Microsoft-Windows-ModernDeployment-Diagnostics-Provider",
        "Microsoft-Windows-Provisioning-Diagnostics-Provider",
        "Microsoft-Windows-AAD",
        "Microsoft-Windows-User Device Registration"
      ]
    },
    {
      "category": "ESP / Shell / Apps",
      "channels": [
        "Microsoft-Windows-Shell-Core",
        "Microsoft-Windows-AppXDeployment",
        "Microsoft-Windows-AppXDeploymentServer",
        "Microsoft-Windows-AppReadiness",
        "Microsoft-Windows-Store"
      ]
    },
    {
      "category": "Security posture / Crypto",
      "channels": [
        "Microsoft-Windows-BitLocker-API",
        "Microsoft-Windows-BitLocker-DrivePreparationTool",
        "Microsoft-Windows-TPM-WMI",
        "Microsoft-Windows-CertificateServicesClient-Lifecycle-System"
      ]
    },
    {
      "category": "Update / Servicing",
      "channels": [
        "Microsoft-Windows-WindowsUpdateClient"
      ]
    },
    {
      "category": "Logon / Session",
      "channels": [
        "Microsoft-Windows-Winlogon",
        "Microsoft-Windows-User Profile Service",
        "Microsoft-Windows-GroupPolicy",
        "Microsoft-Windows-TaskScheduler"
      ]
    },
    {
      "category": "Network",
      "channels": [
        "Microsoft-Windows-NetworkProfile",
        "Microsoft-Windows-Dhcp-Client",
        "Microsoft-Windows-DNS-Client",
        "Microsoft-Windows-NCSI",
        "Microsoft-Windows-WLAN-AutoConfig",
        "Microsoft-Windows-Time-Service"
      ]
    }
  ],
  "blockedEventLogChannels": [
    "Security",
    "Microsoft-Windows-PowerShell",
    "Windows PowerShell",
    "Microsoft-Windows-Sysmon"
  ],
  "allowedCommands": [
    {
      "category": "TPM and Security",
      "commands": [
        "Get-Tpm",
        "Get-SecureBootPolicy",
        "Get-SecureBootUEFI -Name SetupMode"
      ]
    },
    {
      "category": "BitLocker",
      "commands": [
        "Get-BitLockerVolume -MountPoint C:"
      ]
    },
    {
      "category": "Network",
      "commands": [
        "Get-NetAdapter | Select-Object Name, Status, InterfaceDescription, MacAddress, LinkSpeed",
        "Get-DnsClientServerAddress | Select-Object InterfaceAlias, ServerAddresses",
        "Get-NetIPConfiguration | Select-Object InterfaceAlias, IPv4Address, IPv4DefaultGateway, DNSServer",
        "netsh winhttp show proxy",
        "ipconfig /all"
      ]
    },
    {
      "category": "Domain / Identity",
      "commands": [
        "nltest /dsgetdc:",
        "dsregcmd /status"
      ]
    },
    {
      "category": "Certificate",
      "commands": [
        "certutil -store My",
        "$c = Get-ChildItem Cert:\\LocalMachine\\My; if ($c) { $c | Select-Object Subject, Thumbprint, Issuer, NotBefore, NotAfter, HasPrivateKey | ConvertTo-Json } else { '{\"CertificateCount\": 0}' }"
      ]
    },
    {
      "category": "Windows Update",
      "commands": [
        "Get-HotFix | Select-Object -First 10 HotFixID, InstalledOn, Description"
      ]
    },
    {
      "category": "Autopilot / Hardware Identity",
      "commands": [
        "try { $cs = Get-CimInstance -ClassName Win32_ComputerSystem; $bios = Get-CimInstance -ClassName Win32_BIOS; $hash = $null; try { $hash = (Get-CimInstance -Namespace root/cimv2/mdm/dmmap -ClassName MDM_DevDetail_Ext01 -Filter \"InstanceID='Ext' AND ParentID='./DevDetail'\" -ErrorAction Stop).DeviceHardwareData } catch { $hash = \"ERROR: $($_.Exception.Message)\" }; [pscustomobject]@{ Manufacturer = $cs.Manufacturer; Model = $cs.Model; SystemSKU = $cs.SystemSKUNumber; SerialNumber = $bios.SerialNumber; BiosVersion = $bios.SMBIOSBIOSVersion; HardwareHash = $hash } | ConvertTo-Json -Compress } catch { @{ error = $_.Exception.Message } | ConvertTo-Json -Compress }"
      ]
    }
  ],
  "diagnosticsPathPrefixes": [
    "C:\\ProgramData\\AutopilotMonitor",
    "C:\\ProgramData\\Microsoft\\IntuneManagementExtension\\Logs",
    "C:\\Windows\\Panther",
    "C:\\Windows\\Logs",
    "C:\\Windows\\SetupDiag",
    "C:\\Windows\\SoftwareDistribution\\ReportingEvents.log",
    "C:\\Windows\\System32\\winevt\\Logs",
    "C:\\Windows\\CCM\\Logs",
    "C:\\ProgramData\\Microsoft\\DiagnosticLogCSP",
    "C:\\ProgramData\\Microsoft\\Windows\\WER",
    "C:\\Windows\\Logs\\CBS",
    "C:\\Install\\Log"
  ],
  "blockedFilePrefixes": [
    "C:\\Users",
    "C:\\Windows\\System32\\config"
  ],
  "blockedCommandPatterns": [
    "Invoke-WebRequest",
    "Invoke-RestMethod",
    "Start-BitsTransfer",
    "wget",
    "curl",
    "certutil -urlcache",
    "New-LocalUser",
    "Add-LocalGroupMember",
    "net user",
    "net localgroup",
    "bcdedit",
    "bcdboot",
    "schtasks /create",
    "Register-ScheduledTask",
    "Remove-Item -Recurse",
    "Format-Volume",
    "Set-ExecutionPolicy"
  ],
  "maxCommandLength": 2000,
  "blockedInterimTriggerEventTypes": [
    "performance_snapshot",
    "agent_metrics_snapshot",
    "download_progress",
    "network_state_change",
    "network_connectivity_check",
    "log_entry",
    "agent_trace",
    "stall_probe_check"
  ],
  "imeLogDerivedEventTypes": [
    "app_install_started",
    "app_install_completed",
    "app_install_failed",
    "app_install_skipped",
    "app_download_started",
    "app_tracking_summary",
    "download_progress",
    "do_telemetry",
    "script_started",
    "script_completed",
    "script_failed",
    "script_timeout_suspected",
    "esp_phase_changed",
    "ime_agent_version",
    "ime_token_failure",
    "ime_user_session_completed",
    "ime_process_exited",
    "ime_user_token_acquired"
  ]
}