Windows 10, Windows 11, and Windows Server: Use this platform for policy you deploy to devices managed through Security Management for Microsoft Defender for Endpoint. Do not use quotes as they are not supported for either the Value name column or the Value column. Intune name: Office apps launching child processes, Configuration Manager name: Block Office application from creating child processes, GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a. Then select Create if you're creating a new endpoint protection file or Save if you're editing an existing one. This rule detects suspicious properties within an obfuscated script. CSP: ClipboardSettings. The result is that the first rule is applied, and subsequent non-conflicting rules are merged into the policy. You can also set a rule in warn mode via PowerShell by specifying the AttackSurfaceReductionRules_Actions as "Warn". To learn more about Windows licensing, see Windows 10 Licensing and get the Volume Licensing guide for Windows 10. Choose what copy and paste actions are allowed from the local PC and an Application Guard virtual browser. CSP: DataProtection/AllowDirectMemoryAccess. Therefore, GPO is the choice. Choose an existing endpoint protection profile or create a new one. This rule can generate a lot of noise. Intune name: Process creation from Adobe Reader (beta), GUID: 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c, Dependencies: Microsoft Defender Antivirus. More info about Internet Explorer and Microsoft Edge, Use wildcards in the file name and folder path or extension exclusion lists, Block abuse of exploited vulnerable signed drivers, ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules, ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions, Microsoft Defender Antivirus as primary AV (real-time protection on). CSP: AppLocker, Block users from ignoring SmartScreen warnings Test attack surface reduction (ASR) rules, Enable attack surface reduction (ASR) rules, Operationalize attack surface reduction (ASR) rules, Attack surface reduction (ASR) rules reference, Demystifying attack surface reduction rules - Part 1, Demystifying attack surface reduction rules - Part 2, Demystifying attack surface reduction rules - Part 3, Demystifying attack surface reduction rules - Part 4, Use attack surface reduction rules to prevent malware infection, Enable attack surface reduction rules - alternate configurations, Address false positives/negatives in Microsoft Defender for Endpoint, Cloud-delivered protection and Microsoft Defender Antivirus, Turn on cloud-delivered protection in Microsoft Defender Antivirus, Configure and validate exclusions based on extension, name, or location, Microsoft Defender Antivirus platform support, Overview of inventory in the Microsoft 365 Apps admin center, Use role-based access control (RBAC) and scope tags for distributed IT in Intune, Assign device profiles in Microsoft Intune, More info about Internet Explorer and Microsoft Edge, Block credential stealing from the Windows local security authority subsystem (lsass.exe), Block abuse of exploited vulnerable signed drivers, Block persistence through Windows Management Instrumentation (WMI) event subscription, Minimum requirements for Microsoft Defender for Endpoint, Block executable files from running unless they meet a prevalence (1000 machines), age, or trusted list criteria, Block process creations originating from PSExec and WMI commands, Block Office apps from creating executable content, Block executable content from email client and webmail, Block untrusted and unsigned processes that run from USB, Block Office apps from creating child processes, Block only Office communication applications from creating child processes, Block JS/VBS from launching downloaded executable content, Use advanced protection against ransomware, Block persistence through WMI event subscription, Block Office apps from injecting code into other processes, Block Office communication apps from creating child processes, Block Adobe Reader from creating child processes, Launching executable files and scripts that attempt to download or run files, Running obfuscated or otherwise suspicious scripts, Behaviors that apps don't usually occur during normal day-to-day work, attack surface reduction rules best practices, Microsoft Defender for Endpoint E5 or Windows E5 licenses, Passive Mode with Endpoint detection and response (EDR) in Block Mode. On your Group Policy management computer, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and select Edit. November 4, 2022 by Jitesh Kumar Learn how to configure Attack Surface Reduction ASR Rules in Intune. If you are using a different infrastructure configuration than what is listed for Infrastructure requirements (above), you can learn more about deploying attack surface reduction rules using other configurations here: Enable attack surface reduction rules. This rule uses cloud-delivered protection to update its trusted list regularly. ASR and ASR rules are two different things. Those settings then merge into a single superset of settings. Microsoft Defender Antivirus works seamlessly with Microsoft cloud services. By default, ASR Only Per Rule Exclusions is set to Not configured. Intune name: js/vbs executing payload downloaded from Internet (no exceptions), Configuration Manager name: Block JavaScript or VBScript from launching downloaded executable content, GUID: d3e037e1-3eb8-44c8-a917-57927947596d, Dependencies: Microsoft Defender Antivirus, AMSI. Block hardware device installation by device instance identifiers This rule provides an extra layer of protection against ransomware. Where: Select Save. As such, the anti-tampering capabilities of Microsoft Defender for Endpoint . (1) Refers to the modern unified solution for Windows Server 2012 and 2016. This rule protects against social engineering attacks and prevents exploiting code from abusing vulnerabilities in Outlook. Currently, there is no ETA for when this will be fixed. CSP: Browser/AllowSmartScreen, Prevent Smart Screen Prompt Override For Files (Device) When two or more policies have conflicting settings, the conflicting settings aren't added to the combined policy, while settings that dont conflict are added to the superset policy that applies to a device. Open the Microsoft Intune admin center. Expand the dropdown, select Add, and then specify a lower address and then an upper address. Profiles created after that date use a new settings format as found in the Settings Catalog. In this blog . Intune supports the following two settings to exclude specific file and folder paths from evaluation by Attack Surface Reduction rules: Global: Use Attack Surface Reduction Only Exclusions. Protect devices from exploits, This ASR rule is controlled via the following GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25e, Block executable content download from email and webmail clients Behaviors that apps don't usually start during normal day-to-day work Reducing your attack surface means offering attackers fewer ways to perform attacks. Although multiple methods of implementing ASR rules are possible, this guide is based on an infrastructure consisting of. Next, open the Configure Attack Surface Reduction rules policy and add a GUID for each ASR rule you want to configure in the Value name, and the desired state under value. Profiles include: App and browser isolation Manage settings for Windows Defender Application Guard (Application Guard), as part of Defender for Endpoint. Expand the dropdown and then select Add to define a Path to a file or folder to exclude from your attack surface reduction rules. CSP: RemovableDiskDenyWriteAccess, Scan removable drives during full scan Detected file is lsass.exe. Block write access to removable storage Choose an existing ASR rule or create a new one. The following profiles have been updated: Platform: Windows 10 and later: Profiles for this platform are supported on Windows 10 and Windows 11 devices enrolled with Intune. Warn mode is available for most of the ASR rules. Some rules don't work well if un-signed, internally developed application and scripts are in high usage. CSP: Bluetooth/AllowAdvertising, Block bluetooth proximal connections This rule prevents malware from abusing WMI to attain persistence on a device. When a new profile becomes available, it uses the same name of the profile it replaces and includes the same settings as the older profile but in the newer settings format as seen in the Settings Catalog. To set up tenant attach, see Configure tenant attach to support endpoint protection policies. In this blog, we discuss the two attack surface reduction rules introduced in the most recent release of Windows and cover suggested deployment methods and best practices. Files copied from the USB to the disk drive will be blocked by this rule if and when it's about to be executed on the disk drive. Profile: App and browser isolation Profile: Application control Profile: Attack surface reduction rules Profile: Device control Profile: Exploit protection Profile: Web protection (Microsoft Edge Legacy) The result would be that the setup class is blocked on the device. Beginning in April 2022, new profiles for Attack surface reduction policy have begun to release. Intune name: Win32 imports from Office macro code, Configuration Manager name: Block Win32 API calls from Office macros, GUID: 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b. Exclusion paths can use environment variables and wildcards. Block external content from non-enterprise approved sites This section details the settings in Attack Surface Reduction Rules profiles created before April 5, 2022. List of apps that have access to protected folders For guidance on configuring reusable groups, and then adding them to this profile, see Use reusable groups of settings with Intune policies. In these cases, attackers can use tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS. However, consider using each rule for either reusable settings groups or to manage settings you add directly to the rule. To exclude files and folders from ASR rules, use the following cmdlet: Continue to use Add-MpPreference -AttackSurfaceReductionOnlyExclusions to add more files and folders to the list. Requirements Attack surface reduction features across Windows versions You can set attack surface reduction rules for devices that are running any of the following editions and versions of Windows: Windows 11 Pro Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. To work in your environment, you need to plan, test, implement, and operationalize ASR rules carefully. For example: This rule prevents an application from writing a vulnerable signed driver to disk. CSP: AuditApplicationGuard, Allow user-generated browser data to be saved Network domains Although you can no longer create new instances of the older profile, you can continue to edit and use instances of it that you previously created. For attack surface reduction rule GUIDS, see Per rule descriptions in the article: Attack surface reduction rules. As outlined in Use attack surface reduction rules to prevent malware infection, there are multiple attack surface reduction rules within MDE that you can enable to protect your organization. In step 3 Scope tags, scope tags are optional. During your initial preparation, it's vital that you understand the capabilities of the systems that you'll put in place. Find the endpoint security policies for attack surface reduction under Manage in the Endpoint security node of the Microsoft Intune admin center. Block list - Use Add, Import, and Export to manage a list of device identifiers. To allow users to define the value using PowerShell, use the "User Defined" option for the rule in the management platform. Prior to the Attack Surface Reduction capability in Windows Server, rules were marked compliant by default. Within Microsoft Intune, you have five options to configure ASR rules. Attack surface reduction rule merge behavior is as follows: Device Control With settings for device control, you can configure devices for a layered approach to secure removable media. Exploit Protection - Exploit protection settings can help protect against malware that uses exploits to infect devices and spread. With this example, a setup class defined in the blocklist will override the same setup class if found on the allowlist. Non-conflicting rules will not result in an error, and the rule will be applied correctly. . Links to information about configuration management system versions referenced in this table are listed below this table. Type powershell in the Start menu, right-click Windows PowerShell and select Run as administrator. Configuring Microsoft Defender for Endpoint (MDE) attack surface reduction (ASR) rules can help. Allow hardware device installation by device identifiers. Set up of tenant attach includes configuring Configuration Manager device collections to support endpoint security policies from Intune. This ASR rule is controlled via the following GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869. If you manage your computers and devices with Intune, Configuration Manager, or other enterprise-level management platform, the management software will overwrite any conflicting Group Policy settings on startup. CSP: AllowCameraMicrophoneRedirection, Application guard allow print to local printers, Application guard allow print to network printers, Application Guard allow use of Root Certificate Authorities from the user's device CSP: Bluetooth/AllowDiscoverableMode, Block bluetooth pre-pairing Select Configure Attack surface reduction rules and select Enabled. Define a list of apps that have access to read/write to controlled locations. Intune name: Office apps injecting code into other processes (no exceptions), Configuration Manager name: Block Office applications from injecting code into other processes, GUID: 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84. Behaviors that apps don't usually start during normal day-to-day work If you enable the rule to block access to lsass, it will generate a lot of events. As you might have guessed, the answer is: it depends! Expand the dropdown, select Add, and then specify Internal proxy servers. In OMA-URI, type or paste the specific OMA-URI link for the rule that you're adding. Malware authors also use obfuscation to make malicious code harder to read, which hampers close scrutiny by humans and security software. Following are the rules broken out by category: (1) Block abuse of exploited vulnerable signed drivers isn't currently available in Intune Endpoint security. This section details the settings you can find in Exploit protection profiles created before April 5, 2022. Additionally, there are several prerequisites which you must attend to in preparation of your ASR deployment. You can use Microsoft Intune OMA-URI to configure custom ASR rules. With this change you can no longer create new versions of the old profile and they are no longer being developed. To have a driver examined, use this Web site to Submit a driver for analysis. Want to experience Defender for Endpoint? This section details the settings in App and browser isolation profiles created before April 18, 2023. An Attack surface reduction policy, named: ACSC Windows Hardening Guidelines-Attack Surface Reduction. Block bluetooth connections To learn more about this setting, see Block persistence through WMI event subscription. When a device is assigned at least one policy that configures Attack Surface Reduction Only Exclusions, the configured exclusions apply to all attack surface reduction rules that target that device. You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to. This rule prevents VBA macros from calling Win32 APIs. CSP: Storage/RemovableDiskDenyWriteAccess, USB connections (HoloLens only) Under Attack Surface Reduction exceptions, enter individual files and folders. Any of these methods will work: Microsoft Intune Mobile Device Management (MDM) Microsoft Endpoint Configuration Manager Group Policy PowerShell Microsoft Defender Antivirus Exploit Guard contains the following four features. For Profile type, select Endpoint protection. Testing Microsoft Defender for Endpoint (MDE) attack surface reduction (ASR) rules helps you determine if rules will impede line-of-business operations prior to enabling any rule. Attack surface reduction is not only included in paid products, such as Defender for Endpoint, but is also part of Windows 10/11 and Windows Server, although some rules are not supported on older versions. Select Show and enter each file or folder in the Value name column. CSP: DisallowExploitProtectionOverride, Enable Network Protection (Device) Use Add-MpPreference to append or add apps to the list. Attack surface reduction features across Windows versions. See, Exclusions can be added based on certificate and file hashes, by allowing specified Defender for Endpoint file and certificate indicators. Attack surface reduction rules only work on devices with the following conditions: Endpoints are running Windows 10 Enterprise, version 1709 (also known as the Fall Creators Update). For example, if you're updating Chrome; Chrome will access lsass.exe; passwords are stored in lsass on the device. When set to Yes, you can configure the following settings: IP ranges You can enable attack surface reduction rules by using any of these methods: Enterprise-level management such as Intune or Microsoft Configuration Manager is recommended. Although not common, line-of-business applications sometimes use scripts to download and launch installers. There are multiple methods to configure ASR rules. This separation can help simplify future configurations or changes you might make. Removal of duplicates from the list is done to remove the common source of conflicts. Endpoints are using Microsoft Defender Antivirus as the sole antivirus protection app. Individual settings: Use ASR Only Per Rule Exclusions. Add Row closes. CSP: EnableControlledFolderAccess, List of additional folders that need to be protected ASR rules are somehow overlooked by many organizations. Intune name: Process creation from Office communication products (beta), Configuration Manager name: Not available, GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869. Using Intune, it is possible to configure an exclusion for a specific ASR rule. Windows 10 Supported platforms and profiles: Windows 10 and later - Use this platform for policy you deploy to devices managed with Intune. This article provides information about Microsoft Defender for Endpoint attack surface reduction (ASR) rules: ASR rules are categorized as one of two types: For the easiest method to enable the standard protection rules, see: Simplified standard protection option. Each rule you add to the profile can include both reusable settings groups and individual settings that are added directly to the rule. Users can choose to bypass the block warning message and allow the underlying action. CSP: Bluetooth/ServicesAllowedList. To create a new one, select Create Policy and enter information for this profile. This document will go into more detail on deploying ASR rules effectively to stop advanced threats like human-operated ransomware and other threats. Kernel DMA Protection is a platform feature that must be supported by the system at the time of manufacturing. This rule prevents an application from writing a vulnerable signed driver to disk. Both PowerShell and Group Policy require the use of the GUID value of the ASR rules. Microsoft Defender Credential Guard in Windows normally prevents attempts to extract credentials from LSASS. By integrating with Microsoft Edge and popular third-party browsers like Chrome and Firefox, web protection stops web threats without a web proxy and can protect machines while they're away or on-premises. CSP: Bluetooth/AllowPrepairing, Block bluetooth advertising Enables the IT admin to push out a configuration representing the desired system and application mitigation options to all the devices in the organization. After the warning is unblocked, the operation is allowed until the next time the warning message occurs, at which time the end-user will need to reperform the action. Although you can no longer create new instances of the original profile, you can continue to edit and use your existing profiles. Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. The profile settings that manage Device IDs and that support policy merge include: Policy merge applies to the configuration of each setting across the different profiles that apply that specific setting to a device. Under List of additional folders that need to be protected, List of apps that have access to protected folders, and Exclude files and paths from attack surface reduction rules, enter individual files and folders. However, some legitimate line-of-business applications might also generate child processes for benign purposes; such as spawning a command prompt or using PowerShell to configure registry settings. If ASR rules are already set through Endpoint security, in, 2: Audit (Evaluate how the ASR rule would impact your organization if enabled), 6: Warn (Enable the ASR rule but allow the end-user to bypass the block). Attack surface reduction rules (ASR rules) help prevent actions that malware often abuses to compromise devices and networks. After the profile is created, any devices to which the policy should apply will have Microsoft Defender Application Guard enabled. Settings that aren't in conflict are merged, while settings that are in conflict aren't added to the superset of rules. Intune name: Untrusted and unsigned processes that run from USB, Configuration Manager name: Block untrusted and unsigned processes that run from USB, GUID: b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4. To avoid having exclusions applied to all settings on a device, don't use this setting and instead configure ASR Only Per Rule Exclusions for individual settings. You can exclude files and folders from being evaluated by most attack surface reduction rules. In this post, you will learn how to Block Vulnerable Signed Drivers Using Intune ASR Rules. Disable Auto detection of other enterprise proxy servers, Disable Auto detection of other enterprise IP ranges. Nothing more, nothing less. To create a new one, select Create profile and enter information for this profile. Click on "Configure Attack Surface Reduction rules". Excluded files will be allowed to run, and no report or event will be recorded. ! #1 How can I configure/enable ASR rules? Attack surfaces are all the places where your organization is vulnerable to cyber threats and attacks. Your previously created instances of these profiles remain available to use and edit, but all new instances you create will be in the new format.