mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-22 05:43:41 +00:00
112 lines
6.2 KiB
Markdown
112 lines
6.2 KiB
Markdown
---
|
|
title: Enable ASR rules individually to protect your organization
|
|
description: Enable ASR rules to protect your devices from attacks the use macros, scripts, and common injection techniques
|
|
keywords: Attack surface reduction, hips, host intrusion prevention system, protection rules, anti-exploit, antiexploit, exploit, infection prevention, enable, turn on
|
|
search.product: eADQiWindows 10XVcnh
|
|
ms.pagetype: security
|
|
ms.prod: w10
|
|
ms.mktglfcycl: manage
|
|
ms.sitesec: library
|
|
ms.pagetype: security
|
|
ms.localizationpriority: medium
|
|
author: andreabichsel
|
|
ms.author: v-anbic
|
|
ms.date: 10/17/2018
|
|
---
|
|
|
|
# Enable attack surface reduction rules
|
|
|
|
**Applies to:**
|
|
|
|
- [Windows Defender Advanced Threat Protection (Windows Defender ATP)](https://wincom.blob.core.windows.net/documents/Windows10_Commercial_Comparison.pdf)
|
|
|
|
Attack surface reduction rules help prevent actions and apps that are typically used by exploit-seeking malware to infect machines. Attack surface reduction rules are supported on Windows Server 2019 as well as Windows 10 clients.
|
|
|
|
## Enable and audit attack surface reduction rules
|
|
|
|
You can use Group Policy, PowerShell, or MDM CSPs to configure the state or mode for each rule. This can be useful if you only want to enable some rules, or you want to enable rules individually in audit mode.
|
|
|
|
For further details on how audit mode works, and when you might want to use it, see the [audit Windows Defender Exploit Guard topic](audit-windows-defender-exploit-guard.md).
|
|
|
|
Attack surface reduction rules are identified by their unique rule ID.
|
|
|
|
You can manually add the rules by using the GUIDs in the following table:
|
|
|
|
Rule description | GUID
|
|
-|-
|
|
Block executable content from email client and webmail | be9ba2d9-53ea-4cdc-84e5-9B1eeee46550
|
|
Block all Office applications from creating child processes | d4f940ab-401b-4efc-aadc-ad5f3c50688a
|
|
Block Office applications from creating executable content | 3b576869-a4eC-4529-8536-b80a7769e899
|
|
Block Office applications from injecting code into other processes | 75668c1f-73b5-4Cf0-bb93-3ecf5cb7cc84
|
|
Block JavaScript or VBScript from launching downloaded executable content | d3e037e1-3eb8-44c8-a917-57927947596d
|
|
Block execution of potentially obfuscated scripts | 5beb7efe-fd9A-4556-801d-275e5ffc04cc
|
|
Block Win32 API calls from Office macro | 92e97fa1-2edf-4476-bdd6-9dd0B4dddc7b
|
|
Block executable files from running unless they meet a prevalence, age, or trusted list criteria | 01443614-cd74-433a-b99e-2ecdc07bfc25
|
|
Use advanced protection against ransomware | c1db55ab-c21a-4637-bb3f-a12568109d35
|
|
Block credential stealing from the Windows local security authority subsystem (lsass.exe) | 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2
|
|
Block process creations originating from PSExec and WMI commands | d1e49aac-8f56-4280-b9ba-993a6d77406c
|
|
Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
|
|
Block Office communication applications from creating child processes | 26190899-1602-49e8-8b27-eb1d0a1ce869
|
|
Block Adobe Reader from creating child processes | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
|
|
|
|
See the [Attack surface reduction](attack-surface-reduction-exploit-guard.md) topic for details on each rule.
|
|
|
|
### Use Group Policy to enable or audit attack surface reduction rules
|
|
|
|
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and click **Edit**.
|
|
|
|
2. In the **Group Policy Management Editor** go to **Computer configuration** and click **Administrative templates**.
|
|
|
|
3. Expand the tree to **Windows components** > **Windows Defender Antivirus** > **Windows Defender Exploit Guard** > **Attack surface reduction**.
|
|
|
|
4. Double-click the **Configure Attack surface reduction rules** setting and set the option to **Enabled**. You can then set the individual state for each rule in the options section:
|
|
- Click **Show...** and enter the rule ID in the **Value name** column and your desired state in the **Value** column as follows:
|
|
- Block mode = 1
|
|
- Disabled = 0
|
|
- Audit mode = 2
|
|
|
|
|
|
|
|
### Use PowerShell to enable or audit attack surface reduction rules
|
|
|
|
1. Type **powershell** in the Start menu, right click **Windows PowerShell** and click **Run as administrator**
|
|
2. Enter the following cmdlet:
|
|
|
|
```PowerShell
|
|
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Enabled
|
|
```
|
|
|
|
You can enable the feature in audit mode using the following cmdlet:
|
|
|
|
```PowerShell
|
|
Add-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions AuditMode
|
|
```
|
|
Use `Disabled` insead of `AuditMode` or `Enabled` to turn the feature off.
|
|
|
|
>[!IMPORTANT>
|
|
>You must specify the state individually for each rule, but you can combine rules and states in a comma seperated list.
|
|
>
|
|
>In the following example, the first two rules will be enabled, the third rule will be disabled, and the fourth rule will be enabled in audit mode:
|
|
>
|
|
>```PowerShell
|
|
>Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID 1>,<rule ID 2>,<rule ID 3>,<rule ID 4> -AttackSurfaceReductionRules_Actions Enabled, Enabled, Disabled, AuditMode
|
|
>```
|
|
|
|
|
|
You can also the `Add-MpPreference` PowerShell verb to add new rules to the existing list.
|
|
|
|
>[!WARNING]
|
|
>`Set-MpPreference` will always overwrite the existing set of rules. If you want to add to the existing set, you should use `Add-MpPreference` instead.
|
|
>You can obtain a list of rules and their current state by using `Get-MpPreference`
|
|
|
|
|
|
### Use MDM CSPs to enable attack surface reduction rules
|
|
|
|
Use the [./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-attacksurfacereductionrules) configuration service provider (CSP) to individually enable and set the mode for each rule.
|
|
|
|
## Related topics
|
|
|
|
- [Reduce attack surfaces with attack surface reduction rules](attack-surface-reduction-exploit-guard.md)
|
|
- [Customize attack surface reduction](customize-attack-surface-reduction.md)
|
|
- [Evaluate attack surface reduction](evaluate-attack-surface-reduction.md)
|