PowerShell command for e.g., Block abuse of exploited vulnerable signed drivers:ĭepending on the organization’s preferences, As you can see in the above paragraph there are several methods to set the ASR rules. We can use a PowerShell script to set all the available ASR rules. PowerShell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework.

Attack Surface Reduction Rules via PowerShell script.

The Attack Surface Reduction rules profile can be used to configure the Attack Surface Reduction rules and contains nearly all currently available ASR rules.

Attack Surface Reduction Rules via Endpoint Security Attack Surface Reduction rules.

The Security Baseline contains nearly all currently available ASR rules. A security baseline includes a group of Microsoft Defender settings. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers. Security baselines are Microsoft-recommended configuration settings.

Attack Surface Reduction Rules via MDM Security Baseline.

ASR rules and exclusions need to be set via custom OMA-URI’s.

Attack Surface Reduction Rules via custom configuration profileĪ custom configuration profile can be used to configure settings that are available in Configuration Service Provider (CSP).The category Microsoft Defender Exploit Guard contains an Attack Surface Reduction group and contains nearly all currently available ASR rules. Attack Surface Reduction Rules via Endpoint protectionĮndpoint protection configuration profile can be used to control the security of Windows devices.Within Microsoft Intune, you have five options to configure ASR rules. There are several options available to configure the Attack Surface Reduction rules.

Controlled folder access intune