Many line-of-business applications are written with limited security concerns, and they might perform tasks in ways that seem similar to malware. Run all rules in audit mode first so you can understand how they affect your line-of-business applications. Use audit mode to evaluate how attack surface reduction rules would affect your organization if enabled. See Requirements in the 'Enable attack surface reduction rules' article for information about supported operating systems and additional requirement information. In the recommendation details pane, check for user impact to determine what percentage of your devices can accept a new policy enabling the rule in blocking mode without adversely affecting productivity. You can assess how an attack surface reduction rule might affect your network by opening the security recommendation for that rule in Microsoft Defender Vulnerability Management. Operationalize attack surface reduction (ASR) rules.Enable attack surface reduction (ASR) rules.Test attack surface reduction (ASR) rules.Plan attack surface reduction (ASR) rules deployment.Attack surface reduction (ASR) rules deployment overview.Attack surface reduction rules can constrain software-based risky behaviors and help keep your organization safe.įor a sequential, end-to-end process of how to manage ASR rules, see:

However, these behaviors are often considered risky because they're commonly abused by attackers through malware. Such software behaviors are sometimes seen in legitimate applications.

Performing behaviors that apps don't usually initiate during normal day-to-day work.

Running obfuscated or otherwise suspicious scripts.

Launching executable files and scripts that attempt to download or run files.

Configuring attack surface reduction rules in Microsoft Defender for Endpoint can help!Īttack surface reduction rules target certain software behaviors, such as: Reducing your attack surface means protecting your organization's devices and network, which leaves attackers with fewer ways to perform attacks. Your organization's attack surface includes all the places where an attacker could compromise your organization's devices or networks.

Why attack surface reduction rules are important

Sandisk secure access windows 10