ASR rules overview - Microsoft Defender for Endpoint (original) (raw)

Your organization's attack surface includes all the places where an attacker could gain access. For more information, see Attack surface reduction in Microsoft Defender for Endpoint.

Attack surface reduction (ASR) rules in Microsoft Defender Antivirus target risky software behavior on Windows devices that attackers commonly exploit through malware. For example:

• Launching executable files and scripts that attempt to download or run files.
• Running obfuscated or otherwise untrusted scripts.
• Creating child processes from potentially vulnerable applications (for example, Office apps).
• Injecting code into other processes.

Although legitimate apps might also do these things, attackers commonly use malware that behaves the same way.

See the following series of articles to plan, test, implement, and monitor ASR rules:

• ASR rules deployment overview
  • Plan your ASR rules deployment
  • Test ASR rules
  • Enable ASR rules
  • Manage and monitor ASR rules

ASR rules are grouped into the following categories:

• Standard protection rules offer significant security benefits, so Microsoft recommends enabling them in Block mode without the need for extensive testing. Typically, these rules have minimal or no noticeable effect on users, but there are exceptions:
  • Block persistence through WMI event subscription: If you use Microsoft Configuration Manager to manage devices, don't use other available deployment methods (for example, Group Policy or PowerShell) to activate this rule in Block or Warn mode on the device without extensive testing in Audit mode. The Configuration Manager client relies heavily on WMI.
  • Block credential stealing from the Windows local security authority subsystem: If you enabled Local Security Authority (LSA) protection (recommended, along with Credential Guard), this rule is redundant.
• Other ASR rules provide important protection, but require testing in Audit mode before you activate them in Block or Warn mode as described in the Attack surface reduction rules deployment guide.

The available ASR rules, their corresponding GUID values, and their categories are described in the following table:

• Links in the rule names take you to detailed rule descriptions in the ASR rules reference article.
• Other than endpoint security policies in Microsoft Intune and Microsoft Configuration Manager, all other ASR rule configuration methods identify rules by GUID value.
  Any ASR rule name differences between Microsoft Intune and Microsoft Configuration Manager are described in the table.
  Tip
  Microsoft Configuration Manager was previously known by other names:
  • Microsoft System Center Configuration Manager: version 1511 to 1906 (November 2015 to July 2019)
  • Microsoft Endpoint Configuration Manager: version 1910 to 2211 (December 2019 to December 2022)
  • Microsoft Configuration Manager: version 2303 (April 2023) or later
    For support and update information, see Updates and servicing for Configuration Manager.

Requirements for ASR rules

ASR rules require Microsoft Defender Antivirus as the primary anti-virus app on Windows devices:

• Microsoft Defender Antivirus must be enabled and in Active mode. Specifically, Microsoft Defender Antivirus can't be in any of the following modes:
  • Passive
  • Passive Mode with Endpoint Detection and Response (EDR) in Block Mode
  • Limited periodic scanning (LPS)
  • Off
    For more information about modes in Microsoft Defender Antivirus, see How Microsoft Defender Antivirus affects Defender for Endpoint functionality.
• Real-time protection in Microsoft Defender Antivirus must be on.
• Cloud-delivered protection (also referred to as Microsoft Advanced Protection Service or MAPS) is critical to ASR rule functionality. Cloud protection enhances standard real-time protection and is a critical component of preventing breaches from malware. Some ASR rules specifically have Cloud-delivery Protection requirements for Endpoint Detection and Response (EDR) alerts in Defender for Endpoint and user notification pop-ups. For details, see Alerts and notifications from ASR rule actions.
  For the same reason, your environment must allow connections to the Microsoft Defender Antivirus cloud service.
• Microsoft Defender Antivirus component versions must be no more than two versions older than the most currently available version:
  • Platform update version: Updated monthly.
  • MEngine version: Updated monthly.
  • Security intelligence: Microsoft continually updates security intelligence (also known as definitions and signatures) to address the latest threats and to refine detection logic.
    Keeping Microsoft Defender Antivirus versions current helps reduce ASR rule false positives and improves Microsoft Defender Antivirus detection capabilities. For more information about the current versions and how to update the different Microsoft Defender Antivirus components, see Microsoft Defender Antivirus platform support.
• Although ASR rules don't require Microsoft 365 E5, Microsoft recommends the security capabilities of E5 or equivalent subscriptions to take advantage of the following advanced management capabilities:
  • Monitoring, analytics, and workflows in Defender for Endpoint.
  • Reporting and configuration capabilities in the Microsoft Defender XDR portal.
    Advanced management capabilities aren't available with other licenses (for example, Windows Professional or Microsoft 365 E3). However, you can develop your own monitoring and reporting tools on top of the ASR rule events that are generated in Windows Event Viewer on each device (for example, Windows Event Forwarding).
    To learn more about Windows licensing, see Windows Licensing and get the Microsoft Volume Licensing Reference Guide.

Supported operating systems for ASR rules

ASR rules are a Microsoft Defender Antivirus feature available on any edition of Windows that includes Microsoft Defender Antivirus (for example, Windows 11 Home). You can configure ASR rules locally on individual devices by using PowerShell. On Pro and Enterprise editions, you can also use Group Policy.

Centralized management, reporting, and alerting for ASR rules in Microsoft Defender for Endpoint are available in the following editions and versions of Windows:

• Pro and Enterprise editions of Windows 10 or later.
• Windows Server 2012 R2 or later.
• Azure Local (formerly known as Azure Stack HCI) version 23H2 or later.

Note

ASR rules are a Windows feature. They aren't available on Linux or macOS devices, even those onboarded to Microsoft Defender for Endpoint.

For more operating system support information, see Operating system support for ASR rules.

Modes for ASR rules

An ASR rule can be in one of the following modes as described in the following table:

Microsoft recommends Block mode for the standard protection rules, and initial testing in Audit mode for other ASR rules before activating them in Block or Warn mode.

Many line-of-business applications are written with limited security concerns, and they might act in ways that seem similar to malware. By monitoring data from ASR rules in Audit mode and adding exclusions for required apps, you can deploy ASR rules without reducing productivity.

Before enabling ASR rules in Block mode, assess their effects in Audit mode and security recommendations. For more information, see Test ASR rules.

Deployment and configuration methods for ASR rules

Microsoft Defender for Endpoint supports ASR rules but doesn't include a built-in method to deploy ASR rule settings to devices. Instead, you use a separate deployment or management tool to create and distribute ASR rule policies to devices. Not all deployment methods support every ASR rule. For per-rule details, see Deployment method support for ASR rules.

The following table summarizes the available methods. For detailed configuration instructions, see Configure attack surface reduction (ASR) rules and exclusions.

File and folder exclusions for ASR rules

Important

Excluding files or folders can severely reduce ASR rule protection. Excluded files are allowed to run, and no reports or events about the file are recorded. If ASR rules detect files that shouldn't be detected, use Audit mode to test the rule.

You can exclude specific files and folders from being evaluated by ASR rules. Even if an ASR rule determines the file or folder contains malicious behavior, it doesn't block the excluded files from running.

You can use the following methods to exclude files and folders from ASR rules:

• Microsoft Defender Antivirus exclusions: Not all ASR rules honor these exclusions. For more information about Microsoft Defender Antivirus exclusions, see Configure custom exclusions for Microsoft Defender Antivirus.
  Tip
  All ASR rules honor process exclusions in Microsoft Defender Antivirus.
• Global ASR rule exclusions: These exclusions apply to all ASR rules. All ASR rule configuration methods also support configuring global ASR rule exclusions.
• Per-ASR rule exclusions: Assign different exclusions selectively to different ASR rules. Only the following ASR rule configuration methods also support configuring per-ASR rule exclusions:
  • Group Policy (and the corresponding registry settings)
  • Endpoint security policies in Microsoft Intune.
• Indicators of compromise (IoCs): Most ASR rules honor IoCs for blocked files and blocked certificates. For more information about IoCs, see Overview of indicators in Microsoft Defender for Endpoint.

The enforcement of different types of exclusions for ASR rules is summarized in the following table:

When you add exclusions, keep these points in mind:

• Exclusion paths can use environment variables and wildcards. For more information, see Use wildcards in the file name and folder path or extension exclusion lists.
  Tip
  Don't use user environment variables as wildcards in folder and process exclusions. Only use the following types of environment variables as wildcards:
  • System environment variables.
  • Environment variables that apply to processes running as the NT AUTHORITY\SYSTEM account.
    For a list of system environment variables, see System environment variables.
  • Wildcards can't define a drive letter.
  • To exclude more than one folder in a path, use multiple instances of \*\ to indicate multiple nested folders. For example, c:\Folder\*\*\Test.
  • Microsoft Configuration Manager supports wildcards (* or ?).
  • To exclude a file that contains random characters (for example, from automated file generation), use ? symbol. For example, C:\Folder\fileversion?.docx.
• Exclusions apply only when the application or service starts. For example, if you add an exclusion for an update service that's already running, the update service continues to trigger ASR rule detections until you restart the service.

Policy conflicts in ASR rules

If the same device is assigned two different ASR rule policies, potential conflicts can occur based on the following elements:

• Whether the same ASR rules are assigned in different modes.
• Whether conflict management is in place.
• Whether the result is an error.

Nonconflicting ASR rules don't result in errors. The first rule is applied, and subsequent nonconflicting rules are merged into the policy.

If a mobile device management (MDM) solution and Group Policy apply different ASR rule settings to the same device, the Group Policy settings take precedence.

For information about how ASR rule setting conflicts are handled for the available deployment methods in Microsoft Intune, see Devices managed by Intune.

Notifications and alerts for ASR rules

When an ASR rule in Block or Warn mode is triggered on a device, a notification is displayed on the device. You can customize the information in the notifications. For more information, see Customize contact information in Windows Security.

Endpoint Detection and Response (EDR) alerts in Defender for Endpoint are generated when supported ASR rules are triggered.

For specific details about notification and alert functionality, see Alerts and notifications from ASR rule actions.

To view ASR alert activity in the Microsoft Defender portal and on devices in Windows Event Viewer, see Monitor attack surface reduction (ASR) rule activity.

Monitor ASR rule activity

For complete information, see Monitor attack surface reduction (ASR) rule activity.

Related content

• Attack surface reduction (ASR) rules deployment guide
• Plan your attack surface reduction (ASR) rules deployment
• Test your attack surface reduction (ASR) rules deployment
• Enable attack surface reduction (ASR) rules
• Manage and monitor your attack surface reduction (ASR) rules deployment
• Monitor attack surface reduction (ASR) rule activity
• Attack surface reduction (ASR) rules report
• Exclusions for Microsoft Defender for Endpoint and Microsoft Defender Antivirus