This is Susan Bradley for CSO Online. Today i'm going to talk about attack surface reduction rules
Windows 10 has built-in attack surface reduction roles are asr as part of windows defender exploit
guard these settings block certain processes and executable occurring and prevents attackers
from having successful attacks you can use asr features in the following platforms
windows 10 pro 1709 windows 10 enterprise 1709 windows server and windows server 2019
now keep in mind if you have windows 10 pro you'll have less of the features you won't have quite the
same logging that you do with an e5 enterprise but you can still participate in the fun and make
sure you make it harder for attackers recently on twitter one of the microsoft engineers who works
with the advanced threat protection talked about a a post in their threat section that talked about
z loader now if you have a microsoft defender for endpoint license it used to be the microsoft
defender atp or an e5 you can actually look at this write-up now keep in mind that you do not
have to have an e5 license for everyone in your environment in order to see this information
all it takes is one single e5 license and you can get into the microsoft defenders security
center and see these write-ups and i really like them because they give me a lot of mitigation and
defense techniques for example in this write-up they talk particularly about attack surface
reduction roles and one in particular block all office applications from creating child processes
now there's a couple way that ways that you can set these rules up you can use group policy you
can use in tune you can use registry keys and you can also use powershell now especially if you're
just trying them out just to see what they have the impact in your environment you might want to
try powershell or better yet there's a graphical user interface that you can click on and download
to your system out from github that gives you a graphical user interface to setting up the rules
you go to github click on the gui
you download the file
and you run it on your system
once you launch it you can then easily check the different asr rules that you want to enforce now
i recommend that you start by auditing them for at least 30 days and microsoft recommends
this too so turn on auditing for 30 days and see what impact it has in your environment
click on save changes and it will actually save that on your system
if you find that it's not doing any impact to your processes you can come back
later and click on enabled once again save changes and now it's enabled on your system
you want to look for event 1122 in your event logs under applications and services then
microsoft then windows then security mitigations again it's under applications and services log
then microsoft then windows and then it's all the way down under security mitigations
all the way down here and then it's also into kernel mode what you want to do is
look for any one one two two event logs and see what's going on in your systems
and again see if there's anything that will impact your day-to-day environments
see if you can turn it on the one in particular that i recommend that you try to do
if you can is that first one block all office applications from creating child processes
that in particular will help defend from a lot of phishing attacks you may not be able to do some of
the other ones but try to see if you can do that one especially in your high risk environments
you know people that are going to be attacked people that are going to be targeted
people that have fallen for phishing attacks already so you want to review that and again check
your attack surface reduction rules even if you do not have an e5 license this one setting right
here can go a long way you don't need to have an e5 you can just do it within windows 10 pro
so see what happens in your systems see if you can do a better job of protecting your workstations
now one thing to keep in mind that if you use third-party antivirus you will not be able to
use asr rules as it only works when defender is the functioning antivirus you may wish to
determine if your current antivirus and protection platforms provide enough protections with similar
features to the asr rules too often businesses pick antivirus solutions due to licensing and
contractual arrangements so you may want to step back from the current arrangements you have
revisit your deployments and determine if defender and defender with atp provides a better solution
for you long term until next time this is susan bradley for cso online be safe be secure