Attack Surface Reduction (ASR) Rules & Exploit Protection

Harden Windows endpoints against ransomware, macro exploits, and LSASS credential dumping using Microsoft Intune Attack Surface Reduction rules.

Tags:#ASR#Attack Surface Reduction#LSASS#Endpoint Security#Defender#MD-102

Overview

Attack Surface Reduction (ASR) rules are a subset of Microsoft Defender Exploit Guard designed to close the most common attack vectors exploited by malware, ransomware, and malicious email attachments.

Key protections include blocking executable content from email clients, stopping Office applications from creating child processes or injecting code into other processes, and protecting the Local Security Authority Subsystem Service (LSASS) from credential harvesting tools like Mimikatz.

---

When to Use

Scenario	Recommendation	Technical Rationale
Block Credential Stealing (Mimikatz)	Mandatory	Block LSASS credential dumping (`9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2`).
Stop Office Macro Ransomware	Mandatory	Prevent Office apps from spawning child processes (PowerShell/CMD).
New Environment Baseline Deployment	Audit Mode First	Run rules in Audit mode for 14-30 days to detect legitimate enterprise software false positives before enforcing Block.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Endpoint security
    └── Attack surface reduction
        └── Create Policy
            ├── Platform: Windows 10, Windows 11, and Windows Server
            └── Profile: Attack Surface Reduction Rules

---

Step-by-Step Implementation

Top High-Impact ASR Rules:

Block credential stealing from the Windows local security authority subsystem (LSASS):

State: Block (GUID: 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)

Block all Office applications from creating child processes:

State: Block (GUID: d4f940ab-401b-4efc-aadc-ad5f3c50688a)

Block executable content from email client and webmail:

State: Block (GUID: be9ba2d9-53ea-44a7-8f61-b546019724c3)

Block untrusted and unsigned processes that run from USB:

State: Block (GUID: b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4)

Use advanced protection against ransomware:

State: Block (GUID: c1db55ab-c21a-4637-bb3f-a12568109d35)

---

PowerShell Commands

Query Active ASR Rule States & GUIDs on Endpoint:

PowerShell

# Get all ASR rules and their enforcement state (0=Disabled, 1=Block, 2=Audit, 6=Warn)
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

Inspect Blocked ASR Events in Event Viewer:

PowerShell

# Query Event Viewer for ASR blocked actions (Event ID 1121 = Block, 1122 = Audit)
Get-WinEvent -FilterHashtable @{
    LogName = "Microsoft-Windows-Windows Defender/Operational"
    Id = 1121, 1122
} -MaxEvents 10 | Select-Object TimeCreated, Id, Message | Format-List

---

Troubleshooting Matrix

Issue / Error	Root Cause	Resolution
Line-of-Business App Blocked	Legacy in-house software triggering child process or script rules.	Add folder or executable path to Attack Surface Reduction Only Exclusions in the Intune policy.
Rule Not Enforced	Endpoint has a third-party antivirus installed (Symantec/CrowdStrike), which disables Microsoft Defender ASR.	Ensure Microsoft Defender Antivirus is the primary AV or running in Passive Mode with EDR enabled.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Key Exam Traps:

The 4 valid states for an ASR rule in Intune are: Not Configured, Block, Audit, and Warn (where user can click 'Unblock' with a prompt).
The LSASS rule specifically protects against credential theft and pass-the-hash attacks.

PREVIOUS TOPIC3.2 BitLocker Silent Disk Encryption & Key Escrow NEXT TOPIC3.4 Defender for Endpoint: Intune EDR Onboarding