Configure Attack Surface Reduction Rules

# ===========================================================
# ASR RULE GUID REFERENCE - Each rule blocks a specific MITRE
# ATT&CK technique at the endpoint level before execution.
# Modes: 0=Disabled, 1=Block, 2=Audit, 6=Warn
# ===========================================================

# --- Office Rules (MITRE T1566.001 Phishing: Spearphishing Attachment) ---

# Block Office apps from creating executable content
# WHY: Prevents macros from dropping .exe/.dll payloads to disk.
# MITRE: T1204.002 (User Execution: Malicious File)
3B576869-A4EC-4529-8536-B80A7769E899

# Block Office apps from creating child processes
# WHY: Stops Word/Excel from spawning cmd.exe, powershell.exe, etc.
# MITRE: T1059 (Command and Scripting Interpreter)
D4F940AB-401B-4EFC-AADC-AD5F3C50688A

# Block Office apps from injecting code into other processes
# WHY: Prevents DLL injection / process hollowing from Office macros.
# MITRE: T1055 (Process Injection)
75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84

# --- Credential Protection (MITRE T1003.001 OS Credential Dumping: LSASS Memory) ---

# Block credential stealing from LSASS
# WHY: Prevents tools like Mimikatz from reading LSASS process memory
#      to extract plaintext passwords, NTLM hashes, and Kerberos tickets.
# DETECTION: Any non-system process accessing lsass.exe memory.
#            True positive = credential theft tool; false positive = rare
#            (some legacy AV or monitoring agents may trigger this).
9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2

# --- Script Rules (MITRE T1059 Command and Scripting Interpreter) ---

# Block execution of potentially obfuscated scripts
# WHY: Detects Base64 encoding, string concatenation, and character
#      replacement patterns commonly used to evade static detection.
# MITRE: T1027 (Obfuscated Files or Information)
5BEB7EFE-FD9A-4556-801D-275E5FFC04CC

# Block JavaScript or VBScript from launching downloaded executable content
# WHY: Prevents script-based download cradles (e.g., wscript downloading
#      and running a .exe from the internet).
# MITRE: T1059.005 (Visual Basic), T1059.007 (JavaScript)
D3E037E1-3EB8-44C8-A917-57927947596D

# --- Ransomware Protection (MITRE T1486 Data Encrypted for Impact) ---

# Use advanced protection against ransomware
# WHY: Machine-learning model analyzes file characteristics and behavior
#      patterns to block files that resemble ransomware payloads.
# NOTE: Relies on cloud-delivered protection (MAPS) for real-time verdicts.
C1DB55AB-C21A-4637-BB3F-A12568109D35

# --- Email Rules (MITRE T1566.001 Phishing: Spearphishing Attachment) ---

# Block executable content from email client and webmail
# WHY: Prevents users from running .exe, .dll, .scr files directly
#      from Outlook or browser-based email without saving first.
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550

# ---------------------------------------------------------
# WHAT: Verify Defender AV is active and cloud protection is on
# WHY:  ASR rules ONLY function when Defender AV is the primary
#       antivirus (not passive mode). Cloud protection is required
#       for rules that use cloud-based machine learning verdicts.
# ---------------------------------------------------------

# Check AV operational status
# AMRunningMode: "Normal" = primary AV (required for ASR)
#                "Passive" = 3rd-party AV installed (ASR won't work)
#                "SxS Passive" = side-by-side passive mode
# RealTimeProtectionEnabled: Must be True for ASR enforcement
# BehaviorMonitorEnabled: Must be True for behavioral ASR rules
# IoavProtectionEnabled: Internet-origin file scanning (download protection)
Get-MpComputerStatus | Select-Object AMRunningMode,
    RealTimeProtectionEnabled,
    BehaviorMonitorEnabled,
    IoavProtectionEnabled,
    AntivirusEnabled

# Verify cloud-delivered protection settings
# MAPSReporting: 0=Disabled, 1=Basic, 2=Advanced
#   REQUIRED: Must be >= 1; set to 2 for full ASR cloud rule support.
# SubmitSamplesConsent: 0=Prompt, 1=Safe, 2=Never, 3=All
Get-MpPreference | Select-Object MAPSReporting,
    SubmitSamplesConsent

# Check if any ASR rules are already configured on this device
# OUTPUT: Arrays of rule GUIDs and their corresponding action values.
#   Empty arrays = no ASR rules configured yet.
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids,
    AttackSurfaceReductionRules_Actions

# ---------------------------------------------------------
# WHAT: Deploy ASR rules in Audit mode via PowerShell
# WHY:  Audit mode (action value 2) logs what WOULD be blocked
#       without actually blocking it. This is the safe first step
#       to assess impact on legitimate workflows before enforcing.
# ACTION VALUES: 0=Disabled, 1=Block, 2=Audit, 6=Warn
# NOTE: Use Add-MpPreference to append rules; Set-MpPreference
#       would overwrite all existing rules.
# ---------------------------------------------------------

# Block Office apps from creating executable content (Audit)
# MITRE: T1204.002 - logs when macros try to drop executables
Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 `
    -AttackSurfaceReductionRules_Actions 2

# Block Office apps from creating child processes (Audit)
# MITRE: T1059 - logs when Word/Excel spawns cmd, powershell, etc.
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions 2

# Block credential stealing from LSASS (Audit)
# MITRE: T1003.001 - logs LSASS memory access by non-system processes
# WHY: Critical rule - detects Mimikatz, ProcDump targeting lsass.exe
Add-MpPreference -AttackSurfaceReductionRules_Ids 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 `
    -AttackSurfaceReductionRules_Actions 2

# Block execution of potentially obfuscated scripts (Audit)
# MITRE: T1027 - logs Base64-encoded or string-concatenated scripts
Add-MpPreference -AttackSurfaceReductionRules_Ids 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC `
    -AttackSurfaceReductionRules_Actions 2

# Use advanced protection against ransomware (Audit)
# MITRE: T1486 - ML-based detection of ransomware file characteristics
Add-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 `
    -AttackSurfaceReductionRules_Actions 2

# Verify all rules are configured with their action values
# OUTPUT: Parallel arrays - Ids[0] maps to Actions[0], etc.
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids,
    AttackSurfaceReductionRules_Actions

# ---------------------------------------------------------
# WHAT: Generate test events to validate ASR audit logging
# WHY:  Confirms that audit-mode rules are logging correctly
#       and events flow to both local event logs and the portal.
# ---------------------------------------------------------

# Test ASR: trigger the obfuscated script rule (safe simulation)
# WHY: This creates a benign Base64-encoded PowerShell pattern.
#      The obfuscated script ASR rule (5BEB7EFE) should detect
#      the FromBase64String + Invoke-Expression pattern and log
#      an audit event (Event ID 1122) in the Defender event log.
# NOTE: The decoded string is simply 'Write-Host "ASR Test Successful"'
$testCommand = [System.Text.Encoding]::Unicode.GetString(
    [System.Convert]::FromBase64String("VwByAGkAdABlAC0ASABvAHMAdAAgACIAQQBTAFIAIABUAGUAcwB0ACAA
    UwB1AGMAYwBlAHMAcwBmAHUAbAAiAA==")
)
Invoke-Expression $testCommand

# Query the Defender operational event log for ASR events
# Event ID 1121 = ASR rule BLOCKED an action (only in Block mode)
# Event ID 1122 = ASR rule AUDITED an action (logged but not blocked)
# WHY: During initial deployment, you should only see 1122 events.
#      If you see 1121 events, rules may have been set to Block accidentally.
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" |
    Where-Object { $_.Id -in @(1121, 1122) } |
    Select-Object TimeCreated, Id, Message -First 10

# Event ID 1121 = ASR rule blocked (block mode)
# Event ID 1122 = ASR rule audited (audit mode)

// ---------------------------------------------------------
// WHAT: View all ASR audit events across all devices in 30 days
// WHY:  Gives a complete picture of which ASR rules are firing,
//       on which devices, and what processes triggered them.
// TABLE: DeviceEvents - captures all endpoint security events.
// KEY FIELDS:
//   ActionType: "Asr*" prefix identifies ASR events (e.g., AsrOfficeChildProcess)
//   FileName: The process that was blocked/audited
//   FolderPath: Full path to the blocked file
//   ProcessCommandLine: Full command line of the blocked process
//   InitiatingProcessFileName: The parent process that triggered the rule
//                              (e.g., WINWORD.EXE spawning cmd.exe)
//   AccountName: User context under which the action occurred
// FILTER: "Audit" in AdditionalFields isolates audit-only events
//         (excludes Block events for a clean audit-phase analysis).
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| where AdditionalFields has "Audit"
| project Timestamp, DeviceName, ActionType,
    FileName, FolderPath, ProcessCommandLine,
    InitiatingProcessFileName, AccountName
| order by Timestamp desc

// ---------------------------------------------------------
// WHAT: Identify which ASR rules fire most frequently
// WHY:  High-frequency rules are either catching real attacks
//       (good) or generating noise from legitimate apps (needs
//       exclusions). Use this to prioritize investigation.
// LOGIC: Counts events per ActionType (each maps to one ASR rule).
// OUTPUT: Bar chart - tallest bars need attention first.
//   e.g., AsrOfficeChildProcessAudited firing 5000x in 30 days
//   likely means macros are commonly spawning child processes.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| summarize EventCount = count() by ActionType
| order by EventCount desc
| render barchart

// ---------------------------------------------------------
// WHAT: Find processes most likely to be false positives
// WHY:  LOB apps that legitimately trigger ASR rules need exclusions.
//       This query surfaces processes appearing on multiple devices
//       (DeviceCount) with high frequency (EventCount > 10),
//       which strongly suggests legitimate application behavior.
// LOGIC:
//   dcount(DeviceId) = number of unique devices triggering this process.
//   High DeviceCount + consistent FolderPath = enterprise LOB app.
//   Low DeviceCount + Temp folder path = likely suspicious.
// ACTION: Share results with application owners to confirm legitimate use,
//         then add verified LOB apps to ASR per-rule exclusions.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| summarize EventCount = count(),
    DeviceCount = dcount(DeviceId) by
    ActionType, FileName, FolderPath
| where EventCount > 10
| order by EventCount desc

# ---------------------------------------------------------
# WHAT: Manage ASR per-rule exclusions via PowerShell
# WHY:  Exclusions allow specific trusted applications to bypass
#       ASR rules. Per-rule exclusions (AttackSurfaceReductionOnly)
#       apply to ALL ASR rules on this device. For rule-specific
#       exclusions, use Intune's per-rule exclusion feature.
# IMPORTANT: Every exclusion is a potential attack vector.
#            Use exact file paths, not broad folder exclusions.
# ---------------------------------------------------------

# Add a per-rule exclusion for a verified LOB application
# WHY: This healthcare app legitimately spawns child processes
#      from Office, triggering the Office child process ASR rule.
Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\HealthcareApp\clinical.exe"

# View all currently configured ASR exclusions
# OUTPUT: List of file/folder paths excluded from all ASR rules.
Get-MpPreference | Select-Object AttackSurfaceReductionOnlyExclusions

# Remove an exclusion that is no longer needed
# WHY: Regularly prune exclusions to minimize attack surface gaps.
Remove-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\OldApp\legacy.exe"

# ---------------------------------------------------------
# WHAT: Transition Phase 1 ASR rules from Audit to Block mode
# WHY:  Phase 1 targets rules with near-zero false positive rates:
#       LSASS credential theft, email executable content, and
#       ransomware protection. These rarely affect legitimate apps.
# ACTION VALUE: 1 = Block (enforced - action is prevented)
#               2 = Audit (logged only, was previous setting)
# NOTE: Use Set-MpPreference (not Add-) to CHANGE an existing rule's mode.
# ROLLBACK: If issues arise, revert to audit: change Actions to 2.
# ---------------------------------------------------------

# Block credential stealing from LSASS (MITRE T1003.001)
# WHY: Mimikatz, ProcDump, and similar tools will be blocked from
#      reading lsass.exe memory. Very few legitimate tools need this access.
Set-MpPreference -AttackSurfaceReductionRules_Ids 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 `
    -AttackSurfaceReductionRules_Actions 1

# Block executable content from email client and webmail (MITRE T1566.001)
# WHY: Users cannot directly execute .exe/.scr/.bat from email attachments.
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
    -AttackSurfaceReductionRules_Actions 1

# Use advanced protection against ransomware (MITRE T1486)
# WHY: ML-based blocking of files with ransomware characteristics.
Set-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 `
    -AttackSurfaceReductionRules_Actions 1

# Verify updated rule states - confirm Phase 1 rules show action = 1
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids,
    AttackSurfaceReductionRules_Actions

# ---------------------------------------------------------
# WHAT: Set Office macro ASR rules to Warn mode
# WHY:  Warn mode (action value 6) shows a dialog to the user
#       when an ASR rule triggers, letting them unblock the action
#       for 24 hours if it's legitimate. Ideal for environments where
#       some departments use macros but you still want protection.
# MITRE: T1059.005 (VBA macro execution)
# ---------------------------------------------------------

# Set Office child process rule to Warn mode (6 = Warn)
# BEHAVIOR: User sees a toast notification when Word/Excel tries to
#           spawn a child process. They can click "Allow" to bypass
#           the block for 24 hours, or let it be blocked.
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions 6

# Set Office executable content rule to Warn mode
# BEHAVIOR: User is warned when a macro tries to drop an executable file.
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 `
    -AttackSurfaceReductionRules_Actions 6

# KQL query to monitor how often users bypass warn prompts
# WHY: High bypass rates on specific devices may indicate users
#      routinely dismissing security prompts - consider blocking
#      or adding targeted exclusions instead.
# DeviceEvents
# | where ActionType startswith "Asr"
# | where AdditionalFields has "Warn"
# | summarize WarnCount = count() by DeviceName, ActionType
# | order by WarnCount desc

// ---------------------------------------------------------
// WHAT: Track ASR block events over time as a daily trend
// WHY:  A sudden spike in blocks may indicate an active attack
//       campaign. A gradual decline shows policy effectiveness.
//       Use as a KPI dashboard for security leadership reporting.
// FILTER: "Block" in AdditionalFields = only enforced blocks.
// OUTPUT: Time chart with one line per ASR rule, daily granularity.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| where AdditionalFields has "Block"
| summarize BlockCount = count() by
    bin(Timestamp, 1d), ActionType
| render timechart

// ---------------------------------------------------------
// WHAT: Top 20 most frequently blocked processes by ASR rules
// WHY:  Identifies which executables are being stopped most often.
//       High-count entries in C:\Program Files = likely false positives.
//       High-count entries in C:\Users\*\Temp = likely true positives.
// AffectedDevices (dcount): High device count = widespread app.
//                          Low device count = targeted/isolated event.
// ACTION: Review top results - add confirmed LOB apps to exclusions;
//         investigate unknown executables as potential threats.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| where AdditionalFields has "Block"
| summarize BlockCount = count(),
    AffectedDevices = dcount(DeviceId) by
    FileName, FolderPath, ActionType
| order by BlockCount desc
| take 20

// ---------------------------------------------------------
// WHAT: Verify ASR rule coverage - which devices have activity
// WHY:  Devices with zero ASR events may have rules misconfigured,
//       not applied, or the device may be inactive. Cross-reference
//       with device inventory to find coverage gaps.
// LOGIC: dcount(ActionType) = number of distinct rules that fired.
//        LastEvent = when the device last triggered any ASR rule.
// TIME WINDOW: 7 days - short window to catch recent coverage issues.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "Asr"
| summarize RulesTriggered = dcount(ActionType),
    LastEvent = max(Timestamp) by DeviceName
| order by RulesTriggered desc

// ---------------------------------------------------------
// WHAT: Custom detection rule - ASR blocked credential theft
// WHY:  When the LSASS credential theft ASR rule blocks an attempt,
//       it’s a HIGH-CONFIDENCE indicator of active credential harvesting.
//       This is almost never a false positive in production environments.
// MITRE: T1003.001 (OS Credential Dumping: LSASS Memory)
// DETECTION LOGIC: ActionType == "AsrLsassCredentialTheftBlocked" means
//   a non-system process tried to read LSASS memory and was stopped.
// KEY FIELDS:
//   InitiatingProcessFileName = the parent process (e.g., cmd.exe)
//   ProcessCommandLine = exact command used to access LSASS
//   AccountName = user context (check for compromised accounts)
// TRUE POSITIVE: Mimikatz, ProcDump, pypykatz, or custom tools.
// FALSE POSITIVE: Very rare - some legacy monitoring agents.
// FREQUENCY: Run every 1 hour for near-real-time alerting.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(1h)
| where ActionType == "AsrLsassCredentialTheftBlocked"
| project Timestamp, DeviceName, FileName,
    FolderPath, ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine, AccountName
| order by Timestamp desc

// ---------------------------------------------------------
// WHAT: Custom detection rule - ASR blocked ransomware behavior
// WHY:  The ransomware ASR rule (C1DB55AB) uses ML to detect files
//       with ransomware characteristics. A block event means a file
//       was classified as likely ransomware and prevented from executing.
// MITRE: T1486 (Data Encrypted for Impact)
// DETECTION LOGIC: ActionType == "AsrRansomwareBlocked" fires when
//   the ML model's confidence score exceeds the threshold.
// TRUE POSITIVE: Actual ransomware payload blocked pre-execution.
// FALSE POSITIVE: Rare - legitimate file encryption tools (7-Zip, etc.)
//   may occasionally trigger. Verify FileName/FolderPath before excluding.
// RESPONSE: Immediately investigate the device, check for lateral movement.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(1h)
| where ActionType == "AsrRansomwareBlocked"
| project Timestamp, DeviceName, FileName,
    FolderPath, ProcessCommandLine, AccountName
| order by Timestamp desc

# ---------------------------------------------------------
# WHAT: Validate ASR rule state on the local device and export config
# WHY:  Final validation ensures all rules are in their intended mode
#       (Block, Audit, or Warn) and the config is documented for
#       compliance audits and disaster recovery.
# ---------------------------------------------------------

# Read the current ASR configuration
$rules = Get-MpPreference
$ruleIds = $rules.AttackSurfaceReductionRules_Ids
$ruleActions = $rules.AttackSurfaceReductionRules_Actions

# Map numeric action values to human-readable mode names
# 0 = Disabled (rule is off)
# 1 = Block (enforced, action is prevented)
# 2 = Audit (logged only, action is allowed)
# 6 = Warn (user sees a prompt, can bypass for 24h)
$modeMap = @{ 0 = "Disabled"; 1 = "Block"; 2 = "Audit"; 6 = "Warn" }

# Display each rule GUID and its current enforcement mode
for ($i = 0; $i -lt $ruleIds.Count; $i++) {
    $mode = $modeMap[$ruleActions[$i]]
    Write-Host "Rule: $($ruleIds[$i]). Mode: $mode"
}

# Export the full ASR config to JSON for documentation/audit purposes
# OUTPUT: ASR-Config-Export.json containing rule IDs, actions, and exclusions.
$rules | Select-Object AttackSurfaceReductionRules_Ids,
    AttackSurfaceReductionRules_Actions,
    AttackSurfaceReductionOnlyExclusions |
    ConvertTo-Json | Out-File "C:\Temp\ASR-Config-Export.json"