🧱🪟💻ES - Attack Surface Reduction Rules
Attackers rarely bring their own tools. They borrow yours. ASR nails shut the doors Office, PowerShell and the scripting host leave open, so the techniques stop working even when the malware gets in.
What this policy is about 🧱
Attack Surface Reduction is a set of rules that block techniques, not files. Antivirus asks "is this thing bad?". ASR asks a smarter question: "should Word really be spawning PowerShell? Should a script be reading credentials out of LSASS? Should an email attachment be launching an executable?". The answer is almost always no, so ASR says no, regardless of whether the payload is known malware or something brand new.
That is the whole point. Real intrusions are living-off-the-land: they borrow the tools already on the machine, the way Loki always uses your own doors rather than bringing a battering ram. ASR takes those doors off the table. This page sets the rules that are safe to block outright, and audits the single one that needs tuning first.
ASR does not care what the payload is called. It watches behaviour: a macro calling a Win32 API, a child process where there should not be one. That is why it stops attacks antivirus has never seen, and it is included in Business Premium at no extra cost.
Why this matters 🕵️
The techniques ASR blocks are not exotic. They are the first few moves of almost every real-world compromise: a phished document that runs a macro, a script that pulls down the next stage, a tool that scrapes LSASS for a password to move sideways. Block those moves and you break the attack early, before the interesting part, and you do it for free on hardware you already licensed.
It is also the highest-leverage hardening in the Windows baseline. One profile, correctly configured, neutralises a whole category of attack path that no amount of user training reliably prevents. Karen will click the attachment. ASR makes sure the click does not lead anywhere.
🛠️ Configuration
Where: Intune admin center → Endpoint security → Attack surface reduction → Create policy → Windows → Attack Surface Reduction Rules.
Prerequisite: Microsoft Defender Antivirus must be the active antivirus with real-time protection on. ASR rules do nothing if a third-party AV has taken over. Business Premium ships Defender, so on a standard tenant this is already true.
Set these to Block (the standard-protection set)
These are safe to enforce without a long audit. They break attacker techniques, not legitimate work:
- Block all Office applications from creating child processes
- Block Office applications from creating executable content
- Block Office applications from injecting code into other processes
- Block Win32 API calls from Office macros
- Block execution of potentially obfuscated scripts
- Block JavaScript or VBScript from launching downloaded executable content
- Block executable content from email client and webmail
- Block credential stealing from the Windows local security authority subsystem (LSASS)
- Block persistence through WMI event subscription
- Block untrusted and unsigned processes that run from USB
- Block Adobe Reader from creating child processes
- Block abuse of exploited vulnerable signed drivers
- Block rebooting machine in Safe Mode
- Block use of copied or impersonated system tools
- Use advanced protection against ransomware
- Block process creations originating from PSExec and WMI commands (see caveat, this one is a gift on Intune-managed fleets)
Set this to Audit first (the noisy one)
- Block executable files from running unless they meet a prevalence, age, or trusted list criterion. This one blocks any rare or freshly-built executable, which catches a lot of legitimate line-of-business and in-house software. Run it in Audit, watch the reports, build exclusions for the genuine apps, and only then move it to Block.
Deploy the whole profile broadly. The block rules protect from day one; the audited rule measures quietly until you are ready to tighten it.
Caveats ⚠️
PSExec and WMI: your ConfigMgr problem is not your problem. This rule famously breaks Configuration Manager, which is why the internet is full of "audit it for 60 days" warnings. Those warnings are for ConfigMgr shops. On an Intune-only, cloud-native MKB fleet there is no CcmExec to break, so this rule is safe to Block and closes a real lateral-movement path. Enjoy the one time the cloud-native tenant gets the easy answer.
The prevalence rule needs a runway, not courage. Never flip "block unless prevalence/age/trusted" straight to Block in a real tenant. It will block the accountant's twenty-year-old bespoke tool on go-live day. Audit, exclude, then block.
Exclusions are per-rule and surgical. When a legitimate app trips a rule, add a file or folder exclusion for that rule, not a blanket AV exclusion. Keep the list short and reviewed; every exclusion is a hole you opened on purpose.
Defender has to be in charge. Install a third-party AV that takes over real-time protection and ASR silently stops enforcing. If a customer runs another AV, ASR is a conversation before it is a policy.
Watch it, do not just set it. ASR events surface in Defender and Endpoint Analytics. Review the audit data before tightening, and keep an eye on blocks afterwards, because the first sign a rule is too aggressive is a quiet pile of blocked-legitimate-app events, not a phone call.
License and reversibility. ASR rules run on Defender Antivirus, included in Business Premium with Defender for Business, no E5 required. Clean-revert: unassign and the rules stop applying with no residue, which is exactly why a profile quietly moved back to Not configured belongs in drift detection.
🔗 Related
- 📚🪟💻Compliance - System Security - Defender for Endpoint: the compliance side of the same Defender stack.
- 🚦🟢💻CA - Require Compliant Device 🪟: the Conditional Access layer that only lets a hardened device reach the data in the first place.
You cannot stop people clicking, but you can make the click land on concrete. Block the techniques attackers reach for by reflex, audit the one rule that fights back, and the attack surface shrinks to something you can actually defend. 🧱