How to Configure Attack Surface Reduction Rules in Microsoft Defender for Endpoint

Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint block common attack techniques used by malware and exploits. By preventing suspicious behaviors like Office macros spawning child processes or scripts downloading executables, ASR rules significantly reduce your exposure to threats. This guide covers configuring, testing, and managing ASR rules effectively.

Prerequisites

Before configuring ASR rules, ensure:

• Microsoft Defender Antivirus is running in active mode (not passive)
• Windows 10 version 1709+ or Windows 11 (some rules require newer versions)
• Appropriate licenses: Microsoft 365 E5, E5 Security, or Defender for Endpoint P1/P2
• Administrative access to Intune, Group Policy, or devices
• Device onboarding to Defender for Endpoint (for portal visibility)

Understanding ASR Rules

Available Rules

Rule Modes

Step 1: Assess Current State

Before enabling rules, check current configuration:

Using PowerShell

# Check current ASR rule states
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Actions

# Get detailed status
$rules = Get-MpPreference
for ($i = 0; $i -lt $rules.AttackSurfaceReductionRules_Ids.Count; $i++) {
    $id = $rules.AttackSurfaceReductionRules_Ids[$i]
    $action = $rules.AttackSurfaceReductionRules_Actions[$i]
    $actionName = switch ($action) { 0 {"Disabled"} 1 {"Block"} 2 {"Audit"} 6 {"Warn"} }
    Write-Host "$id : $actionName"
}

View in Defender Portal

1. Go to Reports > Security report > Devices
2. Select Attack surface reduction rules card
3. Review rule status and detections across devices

Step 2: Deploy Rules in Audit Mode

Always start with Audit mode to assess impact.

Using Microsoft Intune

1. Sign in to Microsoft Intune admin center
2. Go to Endpoint security > Attack surface reduction
3. Click Create Policy
4. Select:
   • Platform: Windows 10, Windows 11, and Windows Server
   • Profile: Attack Surface Reduction Rules
5. Configure rules:

Recommended Initial Audit Settings:

6. Click Next
7. Assign to a test device group first
8. Click Create

Using Group Policy

1. Open Group Policy Management Editor
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Attack Surface Reduction
3. Configure Configure Attack Surface Reduction rules:
   • Set to Enabled
   • Click Show to add rules
   • Enter GUID and value (2 for Audit):

     BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 = 2
     D4F940AB-401B-4EFC-AADC-AD5F3C50688A = 2
     3B576869-A4EC-4529-8536-B80A7769E899 = 2
     

     Copy

Using PowerShell (Local Testing)

# Enable rules in Audit mode
Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions 2
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions 2
Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions 2

# Verify configuration
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids, AttackSurfaceReductionRules_Actions

Step 3: Monitor Audit Events

Run in Audit mode for 1-2 weeks before enabling Block mode.

Review Events in Defender Portal

1. Go to Hunting > Advanced hunting
2. Run query to find ASR audit events:

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "Asr"
| summarize EventCount = count() by ActionType, FileName, FolderPath
| order by EventCount desc

Review Local Event Logs

1. Open Event Viewer
2. Navigate to: Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational
3. Filter for Event IDs:
   • 1121: Rule blocked action (Block mode)
   • 1122: Rule audited action (Audit mode)
   • 1125: Rule triggered in Warn mode

Analyze False Positives

Identify legitimate applications triggering rules:

DeviceEvents
| where Timestamp > ago(14d)
| where ActionType contains "AsrOfficeMacroWin32ApiCallsAudited"
| summarize Count = count() by FileName, FolderPath, DeviceName
| where Count > 5
| order by Count desc

Common false positive patterns:

• Line-of-business applications using Office automation
• IT admin scripts running from Office
• Third-party Office add-ins with legitimate API calls

Step 4: Configure Exclusions

Add exclusions for legitimate false positives before enabling Block mode.

Add Exclusions via Intune

1. Edit your ASR policy in Intune
2. Under Attack Surface Reduction Rules, find exclusion settings
3. Add exclusions by:
   • File path: C:\Program Files\LegitApp\app.exe
   • Folder path: C:\Program Files\LegitApp\
4. Save and sync

Add Exclusions via PowerShell

# Add folder exclusion
Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\LegitApp"

# Add file exclusion
Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Scripts\approved-script.ps1"

# View current exclusions
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionOnlyExclusions

Exclusion Best Practices

1. Be specific: Exclude specific files, not entire folders
2. Avoid user-writable paths: Never exclude Downloads, Temp, Desktop
3. Document exclusions: Track why each exclusion was added
4. Review periodically: Remove exclusions for decommissioned apps
5. Use signed app exceptions: Where possible, use certificate-based trust

Step 5: Enable Block Mode

After confirming no critical false positives, switch to Block mode.

Phased Rollout Strategy

1. Week 1-2: Audit mode on pilot devices
2. Week 3: Block mode on pilot devices
3. Week 4-5: Audit mode on broader population
4. Week 6+: Block mode org-wide

Enable Block Mode in Intune

1. Edit your ASR policy
2. Change rules from Audit to Block
3. Deploy to broader device groups
4. Monitor for impact

Enable Block Mode via PowerShell

# Set rules to Block mode (1)
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions 1
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A -AttackSurfaceReductionRules_Actions 1
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 -AttackSurfaceReductionRules_Actions 1

Step 6: Monitor and Maintain

Create Alert Rules

Set up alerts for blocked actions:

DeviceEvents
| where ActionType startswith "AsrOffice" and ActionType endswith "Blocked"
| summarize BlockCount = count() by DeviceName, ActionType, bin(Timestamp, 1h)
| where BlockCount > 10

Regular Review Cadence

Report on ASR Effectiveness

// ASR rule effectiveness over 30 days
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| extend RuleId = extract("Asr([A-Za-z]+)(Blocked|Audited)", 1, ActionType)
| extend Mode = extract("Asr([A-Za-z]+)(Blocked|Audited)", 2, ActionType)
| summarize
    Blocked = countif(Mode == "Blocked"),
    Audited = countif(Mode == "Audited")
    by RuleId
| order by Blocked desc

Recommended Rule Configuration

High-Confidence Rules (Enable Block Immediately)

These rules have low false positive rates:

Medium-Confidence Rules (Audit First)

These rules may affect legitimate applications:

Use-Case Dependent Rules

Troubleshooting

Rule Not Blocking

Symptoms: Rule is set to Block but actions aren't prevented.

Solutions:

1. Verify Defender AV is in active mode (not passive)
2. Check that policy is applied: Get-MpPreference
3. Verify device is receiving policy from Intune/GPO
4. Check for broad exclusions overriding the rule
5. Ensure Windows version supports the rule

Excessive Blocking

Symptoms: Legitimate applications are being blocked.

Solutions:

1. Set rule to Audit mode temporarily
2. Identify the specific application triggering blocks
3. Add targeted exclusion for the legitimate application
4. Verify exclusion is scoped appropriately
5. Re-enable Block mode after exclusion

Policy Conflicts

Symptoms: Different rule states on same device.

Solutions:

1. Check for multiple policies (Intune, GPO, local)
2. GPO settings may override Intune
3. Use gpresult /h report.html to see applied policies
4. Consolidate ASR configuration to single policy source

Next Steps

After configuring ASR rules:

• Investigate security incidents blocked by ASR
• Enable Controlled Folder Access for ransomware protection
• Configure Network Protection to block malicious connections
• Implement Exploit Protection for additional hardening

Need help hardening your endpoints? Inventive HQ provides comprehensive endpoint security services including ASR configuration, policy management, and ongoing optimization. Contact us for expert guidance.