mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-17 15:57:23 +00:00
Merge pull request #4374 from MicrosoftDocs/asr
ASR content updates - warn mode plus CFA content updates
This commit is contained in:
Denise Vangel-MSFT
GitHub
commit
d1cb2bc577
@ -185,9 +185,7 @@
|
||||
###### [Report on antivirus protection]()
|
||||
###### [Review protection status and alerts](microsoft-defender-antivirus/report-monitor-microsoft-defender-antivirus.md)
|
||||
###### [Troubleshoot antivirus reporting in Update Compliance](microsoft-defender-antivirus/troubleshoot-reporting.md)
|
||||
|
||||
###### [Manage updates and apply baselines]()
|
||||
###### [Learn about the different kinds of updates](microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md)
|
||||
###### [Learn about the recent updates](microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus.md)
|
||||
###### [Manage protection and security intelligence updates](microsoft-defender-antivirus/manage-protection-updates-microsoft-defender-antivirus.md)
|
||||
###### [Manage when protection updates should be downloaded and applied](microsoft-defender-antivirus/manage-protection-update-schedule-microsoft-defender-antivirus.md)
|
||||
###### [Manage updates for endpoints that are out of date](microsoft-defender-antivirus/manage-outdated-endpoints-microsoft-defender-antivirus.md)
|
||||
|
||||
@ -14,10 +14,10 @@ ms.author: deniseb
|
||||
ms.reviewer: sugamar, jcedola
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
ms.date: 11/30/2020
|
||||
ms.date: 12/10/2020
|
||||
---
|
||||
|
||||
# Reduce attack surfaces with attack surface reduction rules
|
||||
# Use attack surface reduction rules to prevent malware infection
|
||||
|
||||
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
|
||||
|
||||
@ -26,17 +26,17 @@ ms.date: 11/30/2020
|
||||
|
||||
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
|
||||
|
||||
## Overview
|
||||
## Why attack surface reduction rules are important
|
||||
|
||||
Your attack surface includes all the places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means protecting your organization's devices and network, which leaves attackers with fewer ways to perform attacks.
|
||||
Your organization's attack surface includes all the places where an attacker could compromise your organization's devices or networks. Reducing your attack surface means protecting your organization's devices and network, which leaves attackers with fewer ways to perform attacks. Configuring attack surface reduction rules in Microsoft Defender for Endpoint can help!
|
||||
|
||||
Attack surface reduction rules target certain software behaviors that are often abused by attackers. Such behaviors include:
|
||||
Attack surface reduction rules target certain software behaviors, such as:
|
||||
|
||||
- Launching executable files and scripts that attempt to download or run files;
|
||||
- Running obfuscated or otherwise suspicious scripts; and
|
||||
- Performing behaviors that apps don't usually initiate during normal day-to-day work.
|
||||
|
||||
Such software behaviors are sometimes seen in legitimate applications; however, these behaviors are often considered risky because they are commonly abused by malware. Attack surface reduction rules can constrain risky behaviors and help keep your organization safe.
|
||||
Such software behaviors are sometimes seen in legitimate applications; however, these behaviors are often considered risky because they are commonly abused by attackers through malware. Attack surface reduction rules can constrain risky behaviors and help keep your organization safe.
|
||||
|
||||
For more information about configuring attack surface reduction rules, see [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
|
||||
|
||||
@ -44,7 +44,7 @@ For more information about configuring attack surface reduction rules, see [Enab
|
||||
|
||||
You can assess how an attack surface reduction rule might impact your network by opening the security recommendation for that rule in [threat and vulnerability management](https://docs.microsoft.com/windows/security/threat-protection/#tvm).
|
||||
|
||||
:::image type="content" source="images/asrrecommendation.png" alt-text="Security recommendation for ASR rule":::
|
||||
:::image type="content" source="images/asrrecommendation.png" alt-text="Security reco for attack surface reduction rule":::
|
||||
|
||||
In the recommendation details pane, check the user impact to determine what percentage of your devices can accept a new policy enabling the rule in blocking mode without adverse impact to user productivity.
|
||||
|
||||
@ -52,9 +52,49 @@ In the recommendation details pane, check the user impact to determine what perc
|
||||
|
||||
Use [audit mode](audit-windows-defender.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks in ways that seem similar to malware. By monitoring audit data and [adding exclusions](enable-attack-surface-reduction.md#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity.
|
||||
|
||||
## Notifications when a rule is triggered
|
||||
## Warn mode for users
|
||||
|
||||
Whenever a rule is triggered, a notification will be displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays within the Microsoft Defender Security Center and the Microsoft 365 security center.
|
||||
(**NEW**!) Prior to warn mode capabilities, attack surface reduction rules that are enabled could be set to either audit mode or block mode. With the new warn mode, whenever content is blocked by an attack surface reduction rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. When a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes.
|
||||
|
||||
Warn mode helps your organization have attack surface reduction rules in place without preventing users from accessing the content they need to perform their tasks.
|
||||
|
||||
### Requirements for warn mode to work
|
||||
|
||||
Warn mode is supported on devices running the following versions of Windows:
|
||||
- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809) or later
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809) or later
|
||||
|
||||
In addition, make sure [Microsoft Defender Antivirus and antimalware updates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/manage-updates-baselines-microsoft-defender-antivirus#monthly-platform-and-engine-versions) are installed
|
||||
- Minimum platform release requirement: `4.18.2008.9`
|
||||
- Minimum engine release requirement: `1.1.17400.5`
|
||||
|
||||
For more information and to get your updates, see [Update for Microsoft Defender antimalware platform](https://support.microsoft.com/help/4052623/update-for-microsoft-defender-antimalware-platform).
|
||||
|
||||
### Cases where warn mode is not supported
|
||||
|
||||
Warn mode is not supported for the following attack surface reduction rules:
|
||||
|
||||
- [Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) (GUID `d3e037e1-3eb8-44c8-a917-57927947596d`)
|
||||
- [Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) (GUID `e6db77e5-3df2-4cf1-b95a-636979351e5b`)
|
||||
- [Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) (GUID `c1db55ab-c21a-4637-bb3f-a12568109d35`)
|
||||
|
||||
In addition, warn mode is not supported on devices running older versions of Windows. In those cases, attack surface reduction rules that are configured to run in warn mode will run in block mode.
|
||||
|
||||
## Notifications and alerts
|
||||
|
||||
Whenever an attack surface reduction rule is triggered, a notification is displayed on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information.
|
||||
|
||||
In addition, when certain attack surface reduction rules are triggered, alerts are generated.
|
||||
|
||||
Notifications and any alerts that are generated can be viewed in the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and in the Microsoft 365 security center ([https://security.microsoft.com](https://security.microsoft.com)).
|
||||
|
||||
## Advanced hunting and attack surface reduction events
|
||||
|
||||
You can use advanced hunting to view attack surface reduction events. To streamline the volume of incoming data, only unique processes for each hour are viewable with advanced hunting. The time of an attack surface reduction event is the first time that event is seen within the hour.
|
||||
|
||||
For example, suppose that an attack surface reduction event occurs on ten devices during the 2:00 PM hour. Suppose that the first event occurred at 2:15, and the last at 2:45. With advanced hunting, you'll see one instance of that event (even though it actually occurred on ten devices), and its timestamp will be 2:15 PM.
|
||||
|
||||
For more information about advanced hunting, see [Proactively hunt for threats with advanced hunting](advanced-hunting-overview.md).
|
||||
|
||||
## Attack surface reduction features across Windows versions
|
||||
|
||||
@ -93,7 +133,7 @@ You can review the Windows event log to view events generated by attack surface
|
||||
|
||||
5. Select **OK**.
|
||||
|
||||
This will create a custom view that filters events to only show the following, all of which are related to controlled folder access:
|
||||
You can create a custom view that filters events to only show the following events, all of which are related to controlled folder access:
|
||||
|
||||
|Event ID | Description |
|
||||
|---|---|
|
||||
@ -105,25 +145,84 @@ The "engine version" listed for attack surface reduction events in the event log
|
||||
|
||||
## Attack surface reduction rules
|
||||
|
||||
The following sections describe each of the 15 attack surface reduction rules. This table shows their corresponding GUIDs, which you use if you're configuring the rules with Group Policy or PowerShell. If you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs:
|
||||
The following table and subsections describe each of the 15 attack surface reduction rules. The attack surface reduction rules are listed in alphabetical order, by rule name.
|
||||
|
||||
If you are configuring attack surface reduction rules by using Group Policy or PowerShell, you'll need the GUIDs. On the other hand, if you use Microsoft Endpoint Configuration Manager or Microsoft Intune, you do not need the GUIDs.
|
||||
|
||||
|
||||
| Rule name | GUID | File & folder exclusions | Minimum OS supported |
|
||||
|-----|----|---|---|
|
||||
|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|:-----|:-----:|:-----|:-----|
|
||||
|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block all Office applications from creating child processes](#block-all-office-applications-from-creating-child-processes) | `D4F940AB-401B-4EFC-AADC-AD5F3C50688A` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block executable content from email client and webmail](#block-executable-content-from-email-client-and-webmail) | `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Office applications from creating executable content](#block-office-applications-from-creating-executable-content) | `3B576869-A4EC-4529-8536-B80A7769E899` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Office applications from injecting code into other processes](#block-office-applications-from-injecting-code-into-other-processes) | `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block JavaScript or VBScript from launching downloaded executable content](#block-javascript-or-vbscript-from-launching-downloaded-executable-content) | `D3E037E1-3EB8-44C8-A917-57927947596D` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block execution of potentially obfuscated scripts](#block-execution-of-potentially-obfuscated-scripts) | `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block executable files from running unless they meet a prevalence, age, or trusted list criterion](#block-executable-files-from-running-unless-they-meet-a-prevalence-age-or-trusted-list-criterion) | `01443614-cd74-433a-b99e-2ecdc07bfc25` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block credential stealing from the Windows local security authority subsystem (lsass.exe)](#block-credential-stealing-from-the-windows-local-security-authority-subsystem) | `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) |`26190899-1602-49e8-8b27-eb1d0a1ce869` |Supported |[Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater |
|
||||
|[Block process creations originating from PSExec and WMI commands](#block-process-creations-originating-from-psexec-and-wmi-commands) | `d1e49aac-8f56-4280-b9ba-993a6d77406c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block untrusted and unsigned processes that run from USB](#block-untrusted-and-unsigned-processes-that-run-from-usb) | `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Office communication application from creating child processes](#block-office-communication-application-from-creating-child-processes) | `26190899-1602-49e8-8b27-eb1d0a1ce869` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block Adobe Reader from creating child processes](#block-adobe-reader-from-creating-child-processes) | `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Block persistence through WMI event subscription](#block-persistence-through-wmi-event-subscription) | `e6db77e5-3df2-4cf1-b95a-636979351e5b` | Not supported | [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903) (build 18362) or greater |
|
||||
|[Block Win32 API calls from Office macros](#block-win32-api-calls-from-office-macros) | `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|[Use advanced protection against ransomware](#use-advanced-protection-against-ransomware) | `c1db55ab-c21a-4637-bb3f-a12568109d35` | Supported | [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) (RS3, build 16299) or greater |
|
||||
|
||||
### Block Adobe Reader from creating child processes
|
||||
|
||||
This rule prevents attacks by blocking Adobe Reader from creating additional processes.
|
||||
|
||||
Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Intune name: `Process creation from Adobe Reader (beta)`
|
||||
|
||||
Configuration Manager name: Not yet available
|
||||
|
||||
GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c`
|
||||
|
||||
### Block all Office applications from creating child processes
|
||||
|
||||
This rule blocks Office apps from creating child processes. Office apps include Word, Excel, PowerPoint, OneNote, and Access.
|
||||
|
||||
Creating malicious child processes is a common malware strategy. Malware that abuse Office as a vector often run VBA macros and exploit code to download and attempt to run additional payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes, such as spawning a command prompt or using PowerShell to configure registry settings.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: `Office apps launching child processes`
|
||||
|
||||
Configuration Manager name: `Block Office application from creating child processes`
|
||||
|
||||
GUID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A`
|
||||
|
||||
### Block credential stealing from the Windows local security authority subsystem
|
||||
|
||||
This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS).
|
||||
|
||||
LSASS authenticates users who sign in on a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS.
|
||||
|
||||
> [!NOTE]
|
||||
> In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that simply enumerates LSASS, but has no real impact in functionality, there is NO need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: `Flag credential stealing from the Windows local security authority subsystem`
|
||||
|
||||
Configuration Manager name: `Block credential stealing from the Windows local security authority subsystem`
|
||||
|
||||
GUID: `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2`
|
||||
|
||||
### Block executable content from email client and webmail
|
||||
|
||||
@ -138,35 +237,78 @@ This rule was introduced in:
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Microsoft Endpoint Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions)
|
||||
Intune name: `Execution of executable content (exe, dll, ps, js, vbs, etc.) dropped from email (webmail/mail client) (no exceptions)`
|
||||
|
||||
Microsoft Endpoint Configuration Manager name: Block executable content from email client and webmail
|
||||
Microsoft Endpoint Configuration Manager name: `Block executable content from email client and webmail`
|
||||
|
||||
GUID: `BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550`
|
||||
|
||||
### Block all Office applications from creating child processes
|
||||
### Block executable files from running unless they meet a prevalence, age, or trusted list criterion
|
||||
|
||||
This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access.
|
||||
This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list:
|
||||
|
||||
Creating malicious child processes is a common malware strategy. Malware that abuse Office as a vector often run VBA macros and exploit code to download and attempt to run additional payloads. However, some legitimate line-of-business applications might also generate child processes for benign purposes, such as spawning a command prompt or using PowerShell to configure registry settings.
|
||||
- Executable files (such as .exe, .dll, or .scr)
|
||||
|
||||
Launching untrusted or unknown executable files can be risky, as it may not be initially clear if the files are malicious.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule. <br/><br/> The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID `01443614-cd74-433a-b99e-2ecdc07bfc25` is owned by Microsoft and is not specified by admins. This rule uses cloud-delivered protection to update its trusted list regularly.
|
||||
>
|
||||
>You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: `Executables that don't meet a prevalence, age, or trusted list criteria`
|
||||
|
||||
Configuration Manager name: `Block executable files from running unless they meet a prevalence, age, or trusted list criteria`
|
||||
|
||||
GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25`
|
||||
|
||||
### Block execution of potentially obfuscated scripts
|
||||
|
||||
This rule detects suspicious properties within an obfuscated script.
|
||||
|
||||
Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which prevents close scrutiny by humans and security software.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Office apps launching child processes
|
||||
Intune name: `Obfuscated js/vbs/ps/macro code`
|
||||
|
||||
Configuration Manager name: Block Office application from creating child processes
|
||||
Configuration Manager name: `Block execution of potentially obfuscated scripts`
|
||||
|
||||
GUID: `D4F940AB-401B-4EFC-AADC-AD5F3C50688A`
|
||||
GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC`
|
||||
|
||||
### Block JavaScript or VBScript from launching downloaded executable content
|
||||
|
||||
This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet.
|
||||
|
||||
Although not common, line-of-business applications sometimes use scripts to download and launch installers.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: `js/vbs executing payload downloaded from Internet (no exceptions)`
|
||||
|
||||
Configuration Manager name: `Block JavaScript or VBScript from launching downloaded executable content`
|
||||
|
||||
GUID: `D3E037E1-3EB8-44C8-A917-57927947596D`
|
||||
|
||||
### Block Office applications from creating executable content
|
||||
|
||||
This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.
|
||||
|
||||
Malware that abuses Office as a vector may attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique.
|
||||
Malware that abuses Office as a vector may attempt to break out of Office and save malicious components to disk. These malicious components would survive a computer reboot and persist on the system. Therefore, this rule defends against a common persistence technique.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
@ -174,9 +316,9 @@ This rule was introduced in:
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [System Center Configuration Manager](https://docs.microsoft.com/configmgr/core/servers/manage/updates) (SCCM) CB 1710 (SCCM is now Microsoft Endpoint Configuration Manager)
|
||||
|
||||
Intune name: Office apps/macros creating executable content
|
||||
Intune name: `Office apps/macros creating executable content`
|
||||
|
||||
SCCM name: Block Office applications from creating executable content
|
||||
SCCM name: `Block Office applications from creating executable content`
|
||||
|
||||
GUID: `3B576869-A4EC-4529-8536-B80A7769E899`
|
||||
|
||||
@ -196,130 +338,50 @@ This rule was introduced in:
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Office apps injecting code into other processes (no exceptions)
|
||||
Intune name: `Office apps injecting code into other processes (no exceptions)`
|
||||
|
||||
Configuration Manager name: Block Office applications from injecting code into other processes
|
||||
Configuration Manager name: `Block Office applications from injecting code into other processes`
|
||||
|
||||
GUID: `75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84`
|
||||
|
||||
### Block JavaScript or VBScript from launching downloaded executable content
|
||||
### Block Office communication application from creating child processes
|
||||
|
||||
This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet.
|
||||
This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.
|
||||
|
||||
Although not common, line-of-business applications sometimes use scripts to download and launch installers.
|
||||
This rule protects against social engineering attacks and prevents exploit code from abusing vulnerabilities in Outlook. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
> [!NOTE]
|
||||
> This rule applies to Outlook and Outlook.com only.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: js/vbs executing payload downloaded from Internet (no exceptions)
|
||||
Intune name: `Process creation from Office communication products (beta)`
|
||||
|
||||
Configuration Manager name: Block JavaScript or VBScript from launching downloaded executable content
|
||||
Configuration Manager name: Not available
|
||||
|
||||
GUID: `D3E037E1-3EB8-44C8-A917-57927947596D`
|
||||
GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869`
|
||||
|
||||
### Block execution of potentially obfuscated scripts
|
||||
### Block persistence through WMI event subscription
|
||||
|
||||
This rule detects suspicious properties within an obfuscated script.
|
||||
|
||||
Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. Malware authors also use obfuscation to make malicious code harder to read, which prevents close scrutiny by humans and security software.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Obfuscated js/vbs/ps/macro code
|
||||
|
||||
Configuration Manager name: Block execution of potentially obfuscated scripts.
|
||||
|
||||
GUID: `5BEB7EFE-FD9A-4556-801D-275E5FFC04CC`
|
||||
|
||||
### Block Win32 API calls from Office macros
|
||||
|
||||
This rule prevents VBA macros from calling Win32 APIs.
|
||||
|
||||
Office VBA provides the ability to make Win32 API calls. Malware can abuse this capability, such as [calling Win32 APIs to launch malicious shellcode](https://www.microsoft.com/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/) without writing anything directly to disk. Most organizations don't rely on the ability to call Win32 APIs in their day-to-day functioning, even if they use macros in other ways.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Win32 imports from Office macro code
|
||||
|
||||
Configuration Manager name: Block Win32 API calls from Office macros
|
||||
|
||||
GUID: `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B`
|
||||
|
||||
### Block executable files from running unless they meet a prevalence, age, or trusted list criterion
|
||||
|
||||
This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list:
|
||||
|
||||
- Executable files (such as .exe, .dll, or .scr)
|
||||
|
||||
Launching untrusted or unknown executable files can be risky, as it may not be initially clear if the files are malicious.
|
||||
This rule prevents malware from abusing WMI to attain persistence on a device.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule. <br/><br/> The rule **Block executable files from running unless they meet a prevalence, age, or trusted list criterion** with GUID 01443614-cd74-433a-b99e-2ecdc07bfc25 is owned by Microsoft and is not specified by admins. It uses cloud-delivered protection to update its trusted list regularly.
|
||||
>
|
||||
>You can specify individual files or folders (using folder paths or fully qualified resource names) but you can't specify which rules or exclusions apply to.
|
||||
> File and folder exclusions don't apply to this attack surface reduction rule.
|
||||
|
||||
Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
- [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903)
|
||||
- [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909)
|
||||
|
||||
Intune name: Executables that don't meet a prevalence, age, or trusted list criteria.
|
||||
Intune name: Not available
|
||||
|
||||
Configuration Manager name: Block executable files from running unless they meet a prevalence, age, or trusted list criteria
|
||||
Configuration Manager name: Not available
|
||||
|
||||
GUID: `01443614-cd74-433a-b99e-2ecdc07bfc25`
|
||||
|
||||
### Use advanced protection against ransomware
|
||||
|
||||
This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or an exclusion list.
|
||||
|
||||
> [!NOTE]
|
||||
> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Advanced ransomware protection
|
||||
|
||||
Configuration Manager name: Use advanced protection against ransomware
|
||||
|
||||
GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35`
|
||||
|
||||
### Block credential stealing from the Windows local security authority subsystem
|
||||
|
||||
This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS).
|
||||
|
||||
LSASS authenticates users who log in to a Windows computer. Microsoft Defender Credential Guard in Windows 10 normally prevents attempts to extract credentials from LSASS. However, some organizations can't enable Credential Guard on all of their computers because of compatibility issues with custom smartcard drivers or other programs that load into the Local Security Authority (LSA). In these cases, attackers can use hack tools like Mimikatz to scrape cleartext passwords and NTLM hashes from LSASS.
|
||||
|
||||
> [!NOTE]
|
||||
> In some apps, the code enumerates all running processes and attempts to open them with exhaustive permissions. This rule denies the app's process open action and logs the details to the security event log. This rule can generate a lot of noise. If you have an app that simply enumerates LSASS, but has no real impact in functionality, there is NO need to add it to the exclusion list. By itself, this event log entry doesn't necessarily indicate a malicious threat.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Flag credential stealing from the Windows local security authority subsystem
|
||||
|
||||
Configuration Manager name: Block credential stealing from the Windows local security authority subsystem
|
||||
|
||||
GUID: `9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2`
|
||||
GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b`
|
||||
|
||||
### Block process creations originating from PSExec and WMI commands
|
||||
|
||||
@ -333,7 +395,7 @@ This rule was introduced in:
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Intune name: Process creation from PSExec and WMI commands
|
||||
Intune name: `Process creation from PSExec and WMI commands`
|
||||
|
||||
Configuration Manager name: Not applicable
|
||||
|
||||
@ -349,69 +411,50 @@ This rule was introduced in:
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Untrusted and unsigned processes that run from USB
|
||||
Intune name: `Untrusted and unsigned processes that run from USB`
|
||||
|
||||
Configuration Manager name: Block untrusted and unsigned processes that run from USB
|
||||
Configuration Manager name: `Block untrusted and unsigned processes that run from USB`
|
||||
|
||||
GUID: `b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4`
|
||||
|
||||
### Block Office communication application from creating child processes
|
||||
### Block Win32 API calls from Office macros
|
||||
|
||||
This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.
|
||||
This rule prevents VBA macros from calling Win32 APIs.
|
||||
|
||||
This protects against social engineering attacks and prevents exploit code from abusing vulnerabilities in Outlook. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised.
|
||||
Office VBA provides the ability to make Win32 API calls. Malware can abuse this capability, such as [calling Win32 APIs to launch malicious shellcode](https://www.microsoft.com/security/blog/2018/09/12/office-vba-amsi-parting-the-veil-on-malicious-macros/) without writing anything directly to disk. Most organizations don't rely on the ability to call Win32 APIs in their day-to-day functioning, even if they use macros in other ways.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1710](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: `Win32 imports from Office macro code`
|
||||
|
||||
Configuration Manager name: `Block Win32 API calls from Office macros`
|
||||
|
||||
GUID: `92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B`
|
||||
|
||||
### Use advanced protection against ransomware
|
||||
|
||||
This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or an exclusion list.
|
||||
|
||||
> [!NOTE]
|
||||
> This rule applies to Outlook and Outlook.com only.
|
||||
> You must [enable cloud-delivered protection](../microsoft-defender-antivirus/enable-cloud-protection-microsoft-defender-antivirus.md) to use this rule.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809)
|
||||
- [Windows 10, version 1803](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1803)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
- [Configuration Manager CB 1802](https://docs.microsoft.com/configmgr/core/servers/manage/updates)
|
||||
|
||||
Intune name: Process creation from Office communication products (beta)
|
||||
Intune name: `Advanced ransomware protection`
|
||||
|
||||
Configuration Manager name: Not yet available
|
||||
Configuration Manager name: `Use advanced protection against ransomware`
|
||||
|
||||
GUID: `26190899-1602-49e8-8b27-eb1d0a1ce869`
|
||||
GUID: `c1db55ab-c21a-4637-bb3f-a12568109d35`
|
||||
|
||||
### Block Adobe Reader from creating child processes
|
||||
|
||||
This rule prevents attacks by blocking Adobe Reader from creating additional processes.
|
||||
|
||||
Through social engineering or exploits, malware can download and launch additional payloads and break out of Adobe Reader. By blocking child processes from being generated by Adobe Reader, malware attempting to use it as a vector are prevented from spreading.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1809](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1809)
|
||||
- [Windows Server, version 1809](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server-1809)
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
Intune name: Process creation from Adobe Reader (beta)
|
||||
|
||||
Configuration Manager name: Not yet available
|
||||
|
||||
GUID: `7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c`
|
||||
|
||||
### Block persistence through WMI event subscription
|
||||
|
||||
This rule prevents malware from abusing WMI to attain persistence on a device.
|
||||
|
||||
> [!IMPORTANT]
|
||||
> File and folder exclusions don't apply to this attack surface reduction rule.
|
||||
|
||||
Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden.
|
||||
|
||||
This rule was introduced in:
|
||||
- [Windows 10, version 1903](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1903)
|
||||
- [Windows Server 1903](https://docs.microsoft.com/windows-server/get-started-19/whats-new-in-windows-server-1903-1909)
|
||||
|
||||
Intune name: Not yet available
|
||||
|
||||
Configuration Manager name: Not yet available
|
||||
|
||||
GUID: `e6db77e5-3df2-4cf1-b95a-636979351e5b`
|
||||
|
||||
## Related topics
|
||||
## See also
|
||||
|
||||
- [Attack surface reduction FAQ](attack-surface-reduction-faq.md)
|
||||
|
||||
|
||||
@ -11,7 +11,7 @@ ms.localizationpriority: medium
|
||||
author: denisebmsft
|
||||
ms.author: deniseb
|
||||
audience: ITPro
|
||||
ms.date: 11/05/2020
|
||||
ms.date: 12/10/2020
|
||||
ms.reviewer: v-maave
|
||||
manager: dansimp
|
||||
ms.custom: asr
|
||||
@ -28,7 +28,7 @@ ms.custom: asr
|
||||
|
||||
## What is controlled folder access?
|
||||
|
||||
Controlled folder access helps you protect your valuable data from malicious apps and threats, like ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Supported on Windows Server 2019 and Windows 10 clients, controlled folder access can be turned on using the Windows Security App or in Microsoft Endpoint Configuration Manager and Intune (for managed devices).
|
||||
Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Supported on Windows Server 2019 and Windows 10 clients, controlled folder access can be turned on using the Windows Security App, Microsoft Endpoint Configuration Manager, or Intune (for managed devices).
|
||||
|
||||
Controlled folder access works best with [Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
|
||||
|
||||
@ -36,19 +36,41 @@ Controlled folder access works best with [Microsoft Defender for Endpoint](../mi
|
||||
|
||||
Controlled folder access works by only allowing trusted apps to access protected folders. Protected folders are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, and so on, are included in the list of controlled folders.
|
||||
|
||||
Controlled folder access works with a list of trusted software. If an app is included in the list of trusted software, the app works as expected. If not, the app is blocked from making any changes to files that are inside protected folders. Apps are added to the trusted list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization, and that have never displayed any malicious behavior, are deemed trustworthy and automatically added to the list.
|
||||
Controlled folder access works with a list of trusted apps. If an app is included in the list of trusted software, it works as expected. If not, the app is prevented from making any changes to files that are inside protected folders.
|
||||
|
||||
Apps can also be manually added to the trusted list via Configuration Manager and Intune. Additional actions, such as [adding a file indicator](../microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) for the app, can be performed from the Security Center Console.
|
||||
Apps are added to the list based upon their prevalence and reputation. Apps that are highly prevalent throughout your organization and that have never displayed any behavior deemed malicious are considered trustworthy. Those apps are added to the list automatically.
|
||||
|
||||
Apps can also be added manually to the trusted list by using Configuration Manager or Intune. Additional actions, such as [adding a file indicator](../microsoft-defender-atp/respond-file-alerts.md#add-indicator-to-block-or-allow-a-file) for an app, can be performed from the Security Center Console.
|
||||
|
||||
## Why controlled folder access is important
|
||||
|
||||
Controlled folder access is especially useful in helping to protect your documents and information from [ransomware](https://www.microsoft.com/wdsi/threats/ransomware). In a ransomware attack, your files can get encrypted and held hostage. With controlled folder access in place, a notification appears on the computer where an app attempted to make changes to a file in a protected folder. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. You can also enable the rules individually to customize what techniques the feature monitors.
|
||||
|
||||
The protected folders include common system folders (including boot sectors), and you can [add additional folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders.
|
||||
The [protected folders](#review-controlled-folder-access-events-in-windows-event-viewer) include common system folders (including boot sectors), and you can [add additional folders](customize-controlled-folders.md#protect-additional-folders). You can also [allow apps](customize-controlled-folders.md#allow-specific-apps-to-make-changes-to-controlled-folders) to give them access to the protected folders.
|
||||
|
||||
You can use [audit mode](audit-windows-defender.md) to evaluate how controlled folder access would impact your organization if it were enabled. You can also visit the Windows Defender Test ground website at [demo.wd.microsoft.com](https://demo.wd.microsoft.com?ocid=cx-wddocs-testground) to confirm the feature is working and see how it works.
|
||||
|
||||
Controlled folder access is supported on Windows 10, version 1709 and later and Windows Server 2019.
|
||||
Controlled folder access is supported on the following versions of Windows:
|
||||
- [Windows 10, version 1709](https://docs.microsoft.com/windows/whats-new/whats-new-windows-10-version-1709) and later
|
||||
- [Windows Server 2019](https://docs.microsoft.com/windows-server/get-started-19/whats-new-19)
|
||||
|
||||
## Requirements
|
||||
## Windows system folders are protected by default
|
||||
|
||||
Windows system folders are protected by default, along with several other folders:
|
||||
|
||||
- `c:\Users\<username>\Documents`
|
||||
- `c:\Users\Public\Documents`
|
||||
- `c:\Users\<username>\Pictures`
|
||||
- `c:\Users\Public\Pictures`
|
||||
- `c:\Users\Public\Videos`
|
||||
- `c:\Users\<username>\Music`
|
||||
- `c:\Users\Public\Music`
|
||||
- `c:\Users\<username>\Favorites`
|
||||
|
||||
> [!NOTE]
|
||||
> You can configure additional folders as protected, but you cannot remove the Windows system folders that are protected by default.
|
||||
|
||||
## Requirements for controlled folder access
|
||||
|
||||
Controlled folder access requires enabling [Microsoft Defender Antivirus real-time protection](../microsoft-defender-antivirus/configure-real-time-protection-microsoft-defender-antivirus.md).
|
||||
|
||||
@ -56,7 +78,7 @@ Controlled folder access requires enabling [Microsoft Defender Antivirus real-ti
|
||||
|
||||
Defender for Endpoint provides detailed reporting into events and blocks as part of its [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
|
||||
|
||||
You can query Microsoft Defender for Endpoint data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use advanced hunting to see how controlled folder access settings would affect your environment if they were enabled.
|
||||
You can query Microsoft Defender for Endpoint data by using [Advanced hunting](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/advanced-hunting-windows-defender-advanced-threat-protection). If you're using [audit mode](audit-windows-defender.md), you can use [advanced hunting](advanced-hunting-overview.md) to see how controlled folder access settings would affect your environment if they were enabled.
|
||||
|
||||
Example query:
|
||||
|
||||
@ -77,19 +99,19 @@ You can review the Windows event log to see events that are created when control
|
||||
|
||||
4. Navigate to where you extracted *cfa-events.xml* and select it. Alternatively, [copy the XML directly](event-views.md).
|
||||
|
||||
5. Click **OK**.
|
||||
5. Select **OK**.
|
||||
|
||||
After following the procedure, you have created a custom view that shows events related to controlled folder access, as listed in the following table:
|
||||
The following table shows events related to controlled folder access:
|
||||
|
||||
|Event ID | Description |
|
||||
|---|---|
|
||||
|:---|:---|
|
||||
|5007 | Event when settings are changed |
|
||||
|1124 | Audited controlled folder access event |
|
||||
|1123 | Blocked controlled folder access event |
|
||||
|
||||
## View or change the list of protected folders
|
||||
|
||||
### Windows 10 security app
|
||||
You can use the Windows Security app to view the list of folders that are protected by controlled folder access.
|
||||
|
||||
1. On your Windows 10 device, open the Windows Security app.
|
||||
|
||||
@ -105,39 +127,11 @@ After following the procedure, you have created a custom view that shows events
|
||||
|
||||
- To remove a folder, select it, and then select **Remove**.
|
||||
|
||||
> [!NOTE]
|
||||
> [Windows system folders](#windows-system-folders-are-protected-by-default) are protected by default, and you cannot remove them from the list.
|
||||
|
||||
## See also
|
||||
|
||||
- [Evaluate controlled folder access](evaluate-controlled-folder-access.md). Use a dedicated demo tool to see how controlled folder access works, and what events would typically be created.
|
||||
|
||||
|
||||
## Default folders protected by controlled folder access
|
||||
Windows system folders are protected by default. In addition, there are several folders that are protected by controlled folder access by default. You can configure additional folders as protected, but cannot remove the default folders from the controlled folder access protection. See [Protect additional folders](customize-controlled-folders.md#protect-additional-folders) for more information.
|
||||
|
||||
Here's the list of default protected folders:
|
||||
- %USERPROFILE%\Documents
|
||||
- %USERPROFILE%\Favorites
|
||||
- %USERPROFILE%\Music
|
||||
- %USERPROFILE%\Pictures
|
||||
- %USERPROFILE%\Videos
|
||||
- %PUBLIC%\Documents
|
||||
- %PUBLIC%\Music
|
||||
- %PUBLIC%\Pictures
|
||||
- %PUBLIC%\Videos
|
||||
|
||||
You can use the Windows Security app to view the list of default folders protected by controlled folder access:
|
||||
|
||||
1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for **Defender**.
|
||||
|
||||
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then scroll down to the **Ransomware protection** section.
|
||||
|
||||
3. Click the **Manage ransomware protection** link to open the **Ransomware protection** pane.
|
||||
|
||||
4. Under the **Controlled folder access** section, click the **Protected folders** link.
|
||||
|
||||
5. Click **Yes** on the **User Access Control** prompt.
|
||||
|
||||
The **Protected folders** pane displays the folders that are protected by default.
|
||||
|
||||
## In this section
|
||||
|
||||
[Customize controlled folder access](customize-controlled-folders.md). Add additional protected folders, and allow specified apps to access protected folders.
|
||||
- [Evaluate controlled folder access](evaluate-controlled-folder-access.md)
|
||||
- [Customize controlled folder access](customize-controlled-folders.md)
|
||||
- [Protect additional folders](customize-controlled-folders.md#protect-additional-folders)
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user