It’s very likely that you’ll be dealing with a different set of constraints in the networks you protect.įor those looking to dive right in to the logs in their environment, the information will be recorded in two different events:Ĭonfiguring any ASR setting in block mode will cause Windows to deny the behavior and also log the event. Please refer to the descriptions below this summary section for the reasons we’ve made the recommendations. We aimed to be somewhat opinionated in this post to provide value to readers but we also acknowledge that all of the settings have their own environmental nuance. Attack surface reduction rules can constrain these kinds of risky behaviors and help keep your organization safe. Such behaviors are sometimes seen in legitimate applications however, they are considered risky because they are commonly abused by malware.

Performing behaviors that apps don’t usually initiate during normal day-to-day work.Running obfuscated or otherwise suspicious scripts.Launching executable files and scripts that attempt to download or run files.This paragraph from the Microsoft website provides a great overview:ĪSR targets software behaviors that are often abused by attackers, such as: Unlike Windows Defender Exploit Guard, ASR controls are simple on/off switches that administrators can deploy in very short order with group policy or Intune, especially if they plan to use audit-only mode. For those that are new to the topic, Windows Defender Attack Surface Reduction (ASR) is the name Microsoft gave a collection of controls that restrict common malware and exploit techniques on Windows endpoints.

Controlled folder access intune