Attack Surface Reduction Rules (Danish)

This article is about Attack Surface Reduction (ASR) rules - what they are, the affect they can have on Omnidocs solutions and our recommended approach to manage them in situations where files are blocked. 

 

Attack surface reduction rules target certain software behaviours, such as:

• Launching executable files and scripts that attempt to download or run files
• Running obfuscated or otherwise suspicious scripts
• Performing behaviors that apps don't usually initiate during normal day-to-day work

See https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction

Attack surface reduction rules contain one of four settings:

• Not configured/Disabled: The attack surface reduction rule is disabled
• Block/Enabled: The attack surface reduction rule is enabled
• Audit: Allows evaluation how the attack surface reduction rule would impact the organization if enabled - files that would be blocked can be seen in the attack surface reduction rules reporting page in the Microsoft Defender portal
• Warn: The attack surface reduction rule is enabled but allows the end user to bypass the block

Best practice is to test ASR rules in audit mode on a number of devices before enabling them for the whole organization.

See a list of ASR rules here:
https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#per-rule-descriptions

See also:
https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-asr-rules#querying-blocking-and-auditing-events 

 

 

Windows Event Viewer offers a low risk way to identify both the file being blocked and the id of the rule enforcing it. Events here will show the Warning level.

To access the log open Windows Event Viewer and browse to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.

The ID of the log message is the GUID of the ASR rule and the Path shows which file is being blocked.

 

Example 1. Word add-in is blocked by ASR:

 

Per Rule Exclusions are our recommended method to prevent the known issues with VBA add-ins and AA export. It is the minimal impact on the hardening of the device whilst ensuring the operation of our solutions. It is only useful if one knowns, which ASR rule(s) blocks the given file(s) in question (see Recommended approach to blocked solution components)

Read more about configuring per rule exclusions here:

https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-deployment-test#configure-attack-surface-reduction-per-rule-exclusions