Detections
Analytics
18.9.47.5.1.2 Ensure 'Configure Attack Surface Reduction rules: Set the state for each ASR rule' is configured - 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b
Information
This policy setting sets the Attack Surface Reduction rules.The recommended state for this setting is:
9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 - 1 (Block credential stealing from the Windows local security authority subsystem (lsass.exe))
e6db77e5-3df2-4cf1-b95a-636979351e5b - 1 (Block persistence through WMI event subscription)
Recommended Optional Values for this setting:
26190899-1602-49e8-8b27-eb1d0a1ce869 - 1 (Block Office communication application from creating child processes)
3b576869-a4ec-4529-8536-b80a7769e899 - 1 (Block Office applications from creating executable content)
5beb7efe-fd9a-4556-801d-275e5ffc04cc - 1 (Block execution of potentially obfuscated scripts)
75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84 - 1 (Block Office applications from injecting code into other processes)
7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c - 1 (Block Adobe Reader from creating child processes)
92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b - 1 (Block Win32 API calls from Office macro)
Note: More information on ASR rules can be found at the following link: Use Attack surface reduction rules to prevent malware infection | Microsoft Docs
Rationale:
Attack surface reduction helps prevent actions and apps that are typically used by exploit-seeking malware to infect machines.
Impact:
When a rule is triggered, a notification will be displayed from the Action Center.
Solution
To establish the recommended configuration via GP, set the following UI path so that 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 and e6db77e5-3df2-4cf1-b95a-636979351e5b are each set to a value of 1:Computer Configuration\Policies\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Attack Surface Reduction\Configure Attack Surface Reduction rules: Set the state for each ASR rule
Optional Values:
26190899-1602-49e8-8b27-eb1d0a1ce869, 3b576869-a4ec-4529-8536-b80a7769e899, 5beb7efe-fd9a-4556-801d-275e5ffc04cc, 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84, 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c, 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b, b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4, be9ba2d9-53ea-4cdc-84e5-9b1eeee46550, d3e037e1-3eb8-44c8-a917-57927947596d, and d4f940ab-401b-4efc-aadc-ad5f3c50688a,
Note: This Group Policy path may not exist by default. It is provided by the Group Policy template WindowsDefender.admx/adml that is included with the Microsoft Windows 10 Release 1709 Administrative Templates (or newer).
Default Value:
Disabled. (No ASR rules will be configured.)
See Also
Item Details
Category: SYSTEM AND INFORMATION INTEGRITY
References: 800-53|SI-16, CSCv7|8.3
Plugin: Windows
Control ID: f6e8248e70ab1d0864ed6621d60532524339775211a2424c3a2c8b5940854e50