Attack Surface Reduction (ASR) rules in Microsoft Defender for Business block specific behaviours commonly used by malware — before the malware even executes. Here's which rules to enable and why.
Key takeaways
- 1Block Office apps from creating child processes — prevents macro malware from spawning PowerShell
- 2Block executable content in email — prevents executable files attached to email from running
- 3Block credential stealing from Windows local security authority — prevents Mimikatz-style credential dumping
- 4Block process creations originating from PSExec and WMI commands — common lateral movement techniques
- 5Block untrusted and unsigned processes from USB — prevents malicious USB autorun attacks
Most Defender deployments focus on the antivirus and EDR components — both important. But Attack Surface Reduction (ASR) rules are a proactive layer that prevents malicious behaviour from occurring in the first place, often stopping threats that signature-based detection would miss entirely.
What ASR rules do
ASR rules block specific techniques commonly used by malware and attackers:
- Block Office apps from creating child processes — prevents macro malware from spawning PowerShell
- Block executable content in email — prevents executable files attached to email from running
- Block credential stealing from Windows local security authority — prevents Mimikatz-style credential dumping
- Block process creations originating from PSExec and WMI commands — common lateral movement techniques
- Block untrusted and unsigned processes from USB — prevents malicious USB autorun attacks
- Use advanced protection against ransomware — behavioural heuristics targeting ransomware patterns
Audit mode first, enforce second
ASR rules require care. Some rules can break legitimate business applications if applied without testing. The correct approach is to deploy all rules in Audit mode first — logging what would have been blocked — review the audit log for legitimate application impact, and then move rules to Enforce mode once they're confirmed safe for the environment. This process typically takes two to four weeks.
How Optimyze handles ASR deployment
Optimyze deploys ASR rules in Audit mode during the initial Defender for Business deployment, reviews the audit data after two weeks, and transitions rules to Enforce mode with appropriate exclusions where needed. We maintain ASR policy management as part of ongoing Defender management, reviewing and updating rules as Microsoft releases new ones.
