Microsoft has expanded the Attack Surface Reduction rule set and improved the deployment experience. Here's the current recommended rule set and how to deploy it safely without breaking legitimate business applications.
Key takeaways
- 1Block Office applications from creating executable content
- 2Block Office applications from injecting code into other processes
- 3Block Office applications from creating child processes
- 4Block all Office applications from creating child processes (broader than the above)
- 5Block executable content from email client and webmail
Microsoft's Attack Surface Reduction (ASR) rule set continues to expand as new attack techniques emerge. In 2025, several new rules have been added and existing rules refined based on telemetry from Microsoft's global threat intelligence. Here's the current recommended set for Business Premium clients.
The 2025 recommended ASR rule set
Rules Optimyze enforces on all managed clients (after the audit-mode validation period):
- Block Office applications from creating executable content
- Block Office applications from injecting code into other processes
- Block Office applications from creating child processes
- Block all Office applications from creating child processes (broader than the above)
- Block executable content from email client and webmail
- Block execution of potentially obfuscated scripts
- Block JavaScript or VBScript from launching downloaded executable content
- Block process creations originating from PSExec and WMI commands
- Block credential stealing from Windows local security authority subsystem
- Block untrusted and unsigned processes that run from USB
- Use advanced protection against ransomware
- Block Win32 API calls from Office macros (new in 2024)
- Block abuse of exploited vulnerable signed drivers (new in 2024)
The audit approach remains essential
Two rules in particular cause false positives in some environments: "Block Office applications from creating child processes" (can affect some PDF workflows in Outlook) and "Block process creations originating from PSExec" (affects some RMM tools). Audit mode review before enforcement is non-negotiable. Optimyze uses a standard two-week audit period for every new ASR deployment.
