Attack Surface Reduction Rules

Attack Surface Reduction (ASR) rules are a feature of Microsoft Defender for Endpoint (formerly Windows Defender ATP) that helps prevent common attack vectors by blocking specific behaviors and techniques used by malware. These rules are essentially policy-driven restrictions that govern how applications can interact with the operating system and other applications. They are designed to reduce the attack surface—the total set of vulnerabilities and entry points that an attacker can exploit—by restricting certain actions that are often abused.

ASR rules are part of the broader Microsoft Defender for Endpoint suite, which includes endpoint detection and response (EDR), antivirus, and vulnerability management. They are available on Windows 10 Pro, Enterprise, and Education editions (version 1709 or later) and Windows Server 2016 and later. For the exam, you need to know that ASR rules are not available on Windows 10 Home or earlier versions.

ASR rules operate at the kernel level by monitoring system calls and process behaviors. When an application attempts to perform an action that matches an ASR rule (e.g., trying to execute a script from an email client), the rule intercepts the action before it is allowed. The rule then checks the action against its configuration and either blocks it, allows it, or audits it (logs the attempt without blocking). The decision is based on the rule's mode: - Block: The action is prevented, and an event is logged. - Audit: The action is allowed but logged for analysis. - Warn (only available via Intune): The user is prompted with a warning and can choose to allow or block the action. - Disabled: The rule is not enforced.

Internally, ASR rules use Windows Defender's cloud-delivered protection and machine learning to identify suspicious behaviors. They rely on the Microsoft Defender Antivirus engine and the Windows Security Center. When a rule blocks an action, the user sees a notification from Windows Security, and an event is recorded in the Microsoft 365 Defender portal.

ASR rules are identified by GUIDs (Globally Unique Identifiers). The exam expects you to recognize common rule names and their effects, but you do not need to memorize GUIDs. However, knowing that each rule has a specific GUID is important for configuration via PowerShell or Group Policy. There are currently over 15 ASR rules, but the exam focuses on a subset. Key rules include:

Default values: ASR rules are not enabled by default. They must be explicitly configured via Group Policy, Intune, or Microsoft Endpoint Configuration Manager. The recommended mode for most rules is "Block" in production, but "Audit" is often used initially to measure impact.

ASR rules can be configured using several methods:

1. Group Policy: Use Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction. Each rule can be set to Block, Audit, or Disabled. 2. PowerShell: Use the Set-MpPreference cmdlet with the -AttackSurfaceReductionRules_Ids and -AttackSurfaceReductionRules_Actions parameters. Example:

Set-MpPreference -AttackSurfaceReductionRules_Ids "01443614-cd74-433a-b99e-2ecdc07bfc25","d4f940ab-401b-4efc-aadc-ad5f3c50688a" -AttackSurfaceReductionRules_Actions Enabled,Enabled

To verify which ASR rules are active, use PowerShell:

Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

This returns the GUIDs of enabled rules. You can also check the Microsoft 365 Defender portal for events.

ASR rules work alongside other Defender for Endpoint features: - Microsoft Defender Antivirus: Provides real-time protection against malware. ASR rules block behaviors that might bypass antivirus. - Controlled Folder Access: Protects sensitive folders from unauthorized changes. ASR rules can block ransomware from modifying protected folders. - Exploit Protection: Mitigates exploit techniques like buffer overflows. ASR rules complement this by blocking specific attack methods. - Network Protection: Blocks outbound connections to malicious IPs/domains. ASR rules focus on local behaviors.

ASR rules are part of the "Reduce Attack Surface" area in the Microsoft 365 Defender portal. They are independent of Microsoft Defender for Cloud (formerly Azure Defender) but can be managed alongside it for hybrid environments.

For the SC-900 exam, you should know:

Candidates often confuse ASR rules with other Defender features: - Trap: "ASR rules block all malware from running." Reality: ASR rules block specific behaviors, not all malware. Antivirus handles file-based malware. - Trap: "ASR rules are enabled by default." Reality: They are not; they must be configured. - Trap: "ASR rules are available on all Windows editions." Reality: Only Pro, Enterprise, and Education. - Trap: "ASR rules can be set to 'Allow' mode." Reality: There is no Allow mode; the options are Block, Audit, Warn (Intune only), and Disabled.

A large financial organization wanted to protect against credential theft attacks using tools like Mimikatz. They enabled the ASR rule "Block credential stealing from the Windows local security authority subsystem (lsass.exe)" in Block mode across all Windows 10 Enterprise endpoints. The rule works by intercepting any process attempt to open LSASS with specific access rights (e.g., PROCESS_VM_READ). During deployment, they first used Audit mode for two weeks and discovered that a legacy IT management tool required access to LSASS for password rotation. They created an exclusion for that specific tool's executable hash. After switching to Block, they saw a 90% reduction in credential theft attempts logged. The rule has negligible performance impact since it only triggers on specific system calls. Misconfiguration could occur if exclusions are too broad (e.g., excluding all processes from a vendor), which would defeat the purpose.

A healthcare organization was targeted by phishing emails containing malicious Office documents that launched PowerShell to download ransomware. They enabled the rule "Block Office applications from creating child processes" in Block mode. This rule prevents Word, Excel, PowerPoint, and Outlook from spawning other executables like cmd.exe or powershell.exe. Initially, in Audit mode, they found that a legitimate finance add-in for Excel needed to launch a helper process. They worked with the vendor to update the add-in to use a different architecture, then enabled the rule. After deployment, the number of ransomware incidents dropped significantly. A common misconfiguration is setting the rule to Audit and never reviewing logs, leaving a gap. Performance is negligible because the check is lightweight.

A tech company with many developers faced threats from obfuscated JavaScript and VBScript used in drive-by downloads. They enabled "Block execution of potentially obfuscated scripts" to detect and block scripts that use techniques like base64 encoding or excessive string concatenation. In Audit mode, they discovered that some internal build scripts were flagged because they used obfuscation to protect intellectual property. They added those scripts to a trusted list via the -AttackSurfaceReductionOnlyExclusions parameter. After switching to Block, they blocked thousands of malicious script attempts monthly. The rule uses machine learning to evaluate script complexity; it does not block all scripts, only those that appear suspicious. Misconfiguration can occur if exclusions are set too broadly (e.g., excluding all scripts from a network share), which could allow attackers to bypass the rule.