HackBlue

Tools · Windows security and Event Logs · 20 / 27

Microsoft Defender Attack Surface Reduction rules: audit, enable, and read events

Turn on ASR rules in audit mode, read Event IDs 1121 and 1122, and enable the high-value rules that block Office child processes and credential theft from LSASS.

11 min read · practice only with authorization

What ASR rules block

Attack Surface Reduction rules stop behaviors common in attacks rather than specific files: Office applications creating child processes, Office creating executable content, scripts launching downloaded executables, credential stealing from the LSASS process, executable email attachments, and process creation from PSExec and WMI commands, among others. Each rule has a GUID and can be Disabled, Audit, Warn, or Block.

They require Defender as the active antivirus with real-time protection on.

High-value rules to start with

Block credential stealing from the Windows local security authority subsystem (lsass.exe), GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2. Block all Office applications from creating child processes, d4f940ab-401b-4efc-aadc-ad5f3c50688a. Block executable content from email client and webmail, be9ba2d9-53ea-4cdc-84e5-9b1eeee46550. Block abuse of exploited vulnerable signed drivers, 56a863a9-875e-4185-98a7-b882c64b5ce5.

Check Microsoft’s current rule reference before deploying, because new rules are added and some have known compatibility notes.

Lab: audit first

Set two rules to audit mode on a lab VM, then open a Word document with a macro that starts notepad.exe (on your own lab, with macros you wrote). Read Event 1122 in the Defender Operational log, which records an audited hit. Switch the Office rule to block and repeat; the child process is stopped and Event 1121 appears.

Use the audit data from a pilot group for a few weeks to find business tools that trip a rule, then add per-rule exclusions only for those paths.

Snippet
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions AuditMode
Add-MpPreference -AttackSurfaceReductionRules_Ids 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2 -AttackSurfaceReductionRules_Actions AuditMode
Get-MpPreference | Select -Expand AttackSurfaceReductionRules_Ids
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1121,1122} -MaxEvents 20 | Format-List TimeCreated, Id, Message
# after the pilot
Add-MpPreference -AttackSurfaceReductionRules_Ids d4f940ab-401b-4efc-aadc-ad5f3c50688a -AttackSurfaceReductionRules_Actions Enabled

Managing at scale

Deploy ASR through Intune, Group Policy, or Configuration Manager so settings are consistent and cannot be changed locally. Keep a short list of exclusions with owners.

ASR hits in audit mode are also a detection signal. An Office child process hit on a machine where nobody uses macros deserves investigation.

Diagram

Rolling out an ASR rule

  1. Audit

    Enable in AuditMode on a pilot group.

  2. Read

    Collect Event 1122 hits centrally.

  3. Exclude

    Add narrow exclusions for legitimate tools.

  4. Block

    Switch to Enabled; watch Event 1121.

Check yourself

1. Which event records an ASR rule hit in audit mode?

2. Which rule helps stop credential dumping?

3. What is the safest way to start with ASR rules?