Attack surface reduction rules: requirements, modes, deployment and exclusions

Attack surface reduction (ASR) rules block risky software behaviours that malware commonly uses. The details that matter are rule modes, requirements, deployment methods and which exclusions apply.

ASR rules are a Microsoft Defender Antivirus feature for Windows. They target behaviour such as Office apps creating child processes, obfuscated scripts, code injection and credential theft from LSASS.

Requirements

• Defender Antivirus must be the primary antivirus, enabled and in active mode: not passive, passive with EDR in block mode, limited periodic scanning or off.
• Real-time protection on, and cloud-delivered protection (MAPS) on and reachable.
• Antivirus platform and engine no more than two versions behind the latest.
• Windows only: ASR rules aren’t available on macOS or Linux, even when onboarded. Centralised management covers Windows 10 or later Pro and Enterprise, Windows Server 2012 R2 or later, and Azure Local 23H2 or later.
• E5 isn’t required for the rules, but monitoring, reporting and configuration in the Defender portal need E5 or equivalent.

Modes

Warn isn’t supported by Block credential stealing from the Windows local security authority subsystem or Block Office applications from injecting code into other processes, and isn’t available in Configuration Manager. From platform 4.18.26060, using Unblock on a Warn-mode rule needs administrator approval.

Rule categories

• Standard protection rules can go straight to Block without extensive testing: Block abuse of exploited vulnerable signed drivers, Block credential stealing from the Windows local security authority subsystem (redundant if LSA protection is enabled) and Block persistence through WMI event subscription (test carefully with Configuration Manager, which relies on WMI).
• Other ASR rules should be tested in Audit mode first, then moved to Block or Warn.

Some rules depend on cloud protection (for example, the prevalence/age rule, obfuscated scripts and advanced ransomware protection). For several rules, EDR alerts appear only when the cloud protection level is High plus or Zero tolerance.

Deploying rules

Precedence: local PowerShell settings are lowest and are overwritten at startup by policy. Group Policy wins over MDM by default unless MDMWinsOverGP is set to 1 through the Policy CSP. All methods except Intune endpoint security policies and Configuration Manager identify rules by GUID.

This PowerShell, run elevated, adds one rule in Audit mode without changing others; Set-MpPreference would overwrite the existing list.

Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions AuditMode

Audit results can be reviewed in advanced hunting:

DeviceEvents
| where ActionType startswith "Asr"
| where ActionType endswith "Audited"

Exclusions

• Global ASR exclusions apply to all rules and every configuration method supports them.
• Per-rule exclusions are supported only through Group Policy, Intune endpoint security policies and Defender portal endpoint security policies.
• Defender Antivirus file and folder exclusions are honoured by some rules only; all rules honour antivirus process exclusions.
• Most rules honour file and certificate indicators.
• Exclusions take effect when the excluded app or service next starts. Excluded files run without reports or events.

Common trap: Setting a rule to Disabled in one policy to turn it off while another policy enables it - Disabled can cause conflicts; Not configured is functionally off without conflict potential.

Get the whole book

This note is one section of Ultra Transcenders SC-200: Microsoft Security Operations Analyst, an independent study guide that explains every topic the exam covers by technology, with comparison tables, diagrams and the common traps, plus a glossary linked to Microsoft Learn.

About the book · SC-200 terms in the glossary · All SC-200 study notes