<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Endpoint Ransomware Protection — API Reference

## Microsoft Defender PowerShell

```powershell
# Controlled Folder Access
Set-MpPreference -EnableControlledFolderAccess Enabled
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Data"
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\App\app.exe"

# ASR Rules (1=Block, 2=Audit, 6=Warn)
Add-MpPreference -AttackSurfaceReductionRules_Ids "GUID" `
  -AttackSurfaceReductionRules_Actions 1

# Check status
Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled,
  BehaviorMonitorEnabled, IsTamperProtected
Get-MpPreference | Select-Object EnableControlledFolderAccess
```

## CrowdStrike Falcon API

```bash
# List prevention policies
curl -s "https://api.crowdstrike.com/policy/queries/prevention/v1" \
  -H "Authorization: Bearer $CS_TOKEN"

# Get policy details
curl -s "https://api.crowdstrike.com/policy/entities/prevention/v1?ids=POLICY_ID" \
  -H "Authorization: Bearer $CS_TOKEN"

# Contain endpoint
curl -X POST "https://api.crowdstrike.com/devices/entities/devices-actions/v2?action_name=contain" \
  -H "Authorization: Bearer $CS_TOKEN" \
  -d '{"ids":["DEVICE_ID"]}'
```

## AppLocker GPO

```powershell
# Get effective policy
Get-AppLockerPolicy -Effective -Xml

# Test policy against executable
Get-AppLockerPolicy -Effective | Test-AppLockerPolicy -Path "C:\test.exe"

# Export policy for review
Get-AppLockerPolicy -Effective -Xml > policy.xml
```

## Linux Hardening

```bash
# SELinux
getenforce
setenforce 1
sestatus

# Mount options
mount -o remount,noexec,nosuid /tmp
mount -o remount,noexec,nosuid /dev/shm

# ClamAV on-access
clamonacc --config-file=/etc/clamav/clamd.conf
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `asr_action` | ASR rule enforcement level | `1` (Block) |
| `cfa_folders` | Protected folder paths | `D:\Data, E:\Shares` |
| `edr_policy` | EDR prevention policy ID | `abc-123-def` |
| `allowlist` | Approved application paths | `C:\Program Files\*` |
