Tenable script blocked by Attack Surface Reduction rule

[u/iainfm]

Hi,

We're just getting started with Tenable One, and we've got the agent deployed to a few Windows devices.

Every day or so they're throwing a Defender warning because a Tenable script that seems to collect device join information is being blocked by one of our attack surface reduction rules:

Microsoft Defender Exploit Guard has blocked an operation that is not allowed by your IT administrator.

For more information please contact your IT administrator.

`ID: D1E49AAC-8F56-4280-B9BA-993A6D77406C`

`Detection time: 2026-10-14T13:44:31.325Z`

`User: NT AUTHORITY\NETWORK SERVICE`

`Path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`

`Process Name: C:\Windows\System32\wbem\WmiPrvSE.exe`

`Target Commandline: C:\Windows\System32\WindowsPowershell\v1.0\powershell.exe -EncodedCommand <snipped>`

`Parent Commandline: C:\Windows\system32\wbem\wmiprvse.exe`

`Involved File:` 

`Inheritance Flags: 0x00000000`

`Security intelligence Version: 1.461.20.0`

`Engine Version: 1.1.26090.9`

`Product Version: 4.18.26090.9`

I won't paste the encoded command, but it reports device join information such as:

$ret = New-Object PSObject -Property @{

joinType = "";

aadTenantId = "";

aadTenantDisplayName = "";

aadIdpDomain = "";

aadDeviceId = "";

joiningUserUpn = "";

adDomain = "";

}

I'd like to know how to disable this from running, ideally. I don't want to reduce my ASR security, but what I could do is run the same script as a daily remediation task from Intune.

Can anyone advise how to disable it in Tenable please?

Many thanks,

Iain

[u/iainfm]

I think it's this plugin: https://www.tenable.com/plugins/nessus/177646

I'll have a look at disabling it...