Configure Attack Surface Reduction Rules

# ===========================================================
# ASR RULE GUID REFERENCE - Complete catalog of all 19 rules.
# Each rule blocks a specific MITRE ATT&CK technique at the
# endpoint level before execution.
# Modes: 0=Disabled, 1=Block, 2=Audit, 6=Warn
# ===========================================================

# --- Office Rules (MITRE T1566.001 Phishing: Spearphishing Attachment) ---

# Block Office apps from creating executable content
# WHY: Prevents macros from dropping .exe/.dll payloads to disk.
#      Malware abuses Office as a persistence vector by saving
#      malicious components (executables, scripts) to disk so they
#      survive a reboot and execute later.
# MITRE: T1204.002 (User Execution: Malicious File)
# APPLIES TO: Word, Excel, PowerPoint, OneNote, Access
3B576869-A4EC-4529-8536-B80A7769E899

# Block all Office apps from creating child processes
# WHY: Stops Word/Excel/PowerPoint/OneNote/Access from spawning
#      cmd.exe, powershell.exe, mshta.exe, wscript.exe, etc.
#      Macro-based malware commonly spawns a shell to download
#      and execute second-stage payloads.
# MITRE: T1059 (Command and Scripting Interpreter)
# APPLIES TO: Word, Excel, PowerPoint, OneNote, Access
D4F940AB-401B-4EFC-AADC-AD5F3C50688A

# Block Office apps from injecting code into other processes
# WHY: Prevents DLL injection / process hollowing from Office macros.
#      Attackers use code injection to migrate malicious code into
#      a clean process (e.g., explorer.exe) so it masquerades as
#      legitimate activity and evades detection.
# MITRE: T1055 (Process Injection)
# APPLIES TO: Word, Excel, OneNote, PowerPoint
# NOTE: Requires restarting Microsoft 365 Apps after configuration.
#       Does NOT support Warn mode.
75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84

# Block Office communication application from creating child processes
# WHY: Prevents Outlook from spawning child processes while still
#      allowing legitimate Outlook functions. Attackers exploit
#      Outlook rules and forms to execute arbitrary commands when
#      a user's credentials are compromised.
# MITRE: T1137 (Office Application Startup),
#        T1059 (Command and Scripting Interpreter)
# APPLIES TO: Outlook
26190899-1602-49E8-8B27-EB1D0A1CE869

# Block Win32 API calls from Office macros
# WHY: Prevents VBA macros from calling Win32 APIs directly.
#      Malware abuses Win32 API calls from VBA to launch shellcode
#      entirely in memory without writing anything to disk,
#      bypassing file-based detection.
# MITRE: T1106 (Native API), T1059.005 (Visual Basic)
# NOTE: Only supported on Windows 10; not on Windows Server.
92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B

# --- Adobe Reader Rules ---

# Block Adobe Reader from creating child processes
# WHY: Prevents Adobe Reader from spawning processes after opening
#      a malicious PDF. Attackers embed exploits or social engineering
#      lures in PDFs that, when opened, launch cmd.exe, powershell.exe,
#      or mshta.exe to download second-stage payloads.
# MITRE: T1204.002 (User Execution: Malicious File),
#        T1566.001 (Phishing: Spearphishing Attachment)
# APPLIES TO: Adobe Acrobat Reader
7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C

# --- Script Rules (MITRE T1059 Command and Scripting Interpreter) ---

# Block execution of potentially obfuscated scripts
# WHY: Detects Base64 encoding, string concatenation, and character
#      replacement patterns commonly used to evade static detection.
#      Malware authors obfuscate scripts to hide malicious intent;
#      legitimate software rarely uses heavy obfuscation.
# MITRE: T1027 (Obfuscated Files or Information)
# NOTE: Requires cloud-delivered protection (MAPS) enabled.
#       Supports PowerShell, JavaScript, and VBScript.
5BEB7EFE-FD9A-4556-801D-275E5FFC04CC

# Block JavaScript or VBScript from launching downloaded executable content
# WHY: Prevents script-based download cradles (e.g., wscript downloading
#      and running a .exe from the internet). JS/VBS downloaders are
#      among the most common initial access vectors in phishing campaigns.
# MITRE: T1059.005 (Visual Basic), T1059.007 (JavaScript)
D3E037E1-3EB8-44C8-A917-57927947596D

# --- Email Rules (MITRE T1566.001 Phishing: Spearphishing Attachment) ---

# Block executable content from email client and webmail
# WHY: Prevents users from running .exe, .dll, .scr, .ps1, .vbs, .js,
#      and archive files directly from Outlook or browser-based webmail.
#      Email-borne executables are a top initial access vector.
# APPLIES TO: Microsoft Outlook desktop app, Outlook.com, and other
#             popular webmail providers accessed via browser.
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550

# --- Credential Protection (MITRE T1003.001 OS Credential Dumping: LSASS Memory) ---

# Block credential stealing from LSASS
# WHY: Prevents tools like Mimikatz, ProcDump, and comsvcs.dll from
#      reading LSASS process memory to extract plaintext passwords,
#      NTLM hashes, and Kerberos tickets.
# DETECTION: Any non-system process accessing lsass.exe memory.
#            True positive = credential theft tool; false positive = rare
#            (some legacy AV or monitoring agents may trigger this).
# NOTE: Not required if LSA protection is already enabled.
#       Skip audit mode - go straight to block (high volume of
#       benign audit events, almost all safe to ignore).
9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2

# --- Ransomware Protection (MITRE T1486 Data Encrypted for Impact) ---

# Use advanced protection against ransomware
# WHY: Machine-learning model analyzes file characteristics and behavior
#      patterns to block files that resemble ransomware payloads.
#      Uses both client and cloud heuristics. Files that are signed,
#      prevalent, or deemed unharmful by cloud analysis are allowed.
# NOTE: Requires cloud-delivered protection (MAPS) for real-time verdicts.
C1DB55AB-C21A-4637-BB3F-A12568109D35

# --- Exploit Protection ---

# Block abuse of exploited vulnerable signed drivers
# WHY: Prevents applications from writing a vulnerable signed driver
#      to disk. Attackers use legitimately signed but vulnerable
#      drivers to gain kernel-level access, disable security tools,
#      or escalate privileges (Bring Your Own Vulnerable Driver).
# MITRE: T1068 (Exploitation for Privilege Escalation),
#        T1562.001 (Impair Defenses: Disable or Modify Tools)
# NOTE: Does NOT block a vulnerable driver already loaded in memory.
#       Standard protection rule - Microsoft recommends always enabling.
56A863A9-875E-4185-98A7-B882C64B5CE5

# Block process creations originating from PSExec and WMI commands
# WHY: Blocks processes spawned by PsExec and WMI remote execution.
#      Attackers abuse these tools for lateral movement and remote
#      command execution across the network.
# MITRE: T1570 (Lateral Tool Transfer), T1047 (WMI)
# WARNING: Incompatible with Microsoft Configuration Manager (SCCM/MECM)
#          because SCCM uses WMI commands for normal client operations.
#          Only use this rule if devices are managed by Intune or another MDM.
D1E49AAC-8F56-4280-B9BA-993A6D77406C

# Block rebooting machine in Safe Mode
# WHY: Prevents attackers from using bcdedit/bootcfg to force a reboot
#      into Safe Mode where most security products are disabled or
#      operate in limited capacity. Attackers use Safe Mode to tamper
#      with defenses, encrypt files, or exfiltrate data undetected.
# MITRE: T1562.009 (Impair Defenses: Safe Mode Boot)
# NOTE: Safe Mode is still accessible manually from Windows Recovery.
33DDEDF1-C6E0-47CB-833E-DE6133960387

# --- USB / Removable Media ---

# Block untrusted and unsigned processes that run from USB
# WHY: Prevents unsigned or untrusted executables (.exe, .dll, .scr)
#      from running off USB removable drives and SD cards.
#      Blocks execution when the file is copied from USB to the disk
#      and about to be executed - stops USB-based malware delivery.
# MITRE: T1091 (Replication Through Removable Media),
#        T1052 (Exfiltration Over Physical Medium)
B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4

# --- Prevalence / Reputation ---

# Block executable files unless they meet prevalence, age, or trusted list
# WHY: Blocks unknown executables that haven't built reputation yet.
#      Uses cloud-delivered protection to maintain a regularly-updated
#      trusted list. Prevents running of novel/zero-day malware that
#      has no known prevalence in the environment.
# MITRE: T1204.002 (User Execution: Malicious File)
# NOTE: Requires cloud-delivered protection (MAPS) enabled.
#       Can cause false positives with custom/internal tools - test
#       thoroughly and use per-rule exclusions.
01443614-CD74-433A-B99E-2ECDC07BFC25

# --- Persistence Prevention ---

# Block persistence through WMI event subscription
# WHY: Prevents malware from creating WMI event subscriptions that
#      execute code when specific system events occur (e.g., logon,
#      timer, process start). This is a fileless persistence technique
#      that survives reboots without writing to the filesystem.
# MITRE: T1546.003 (Event Triggered Execution: WMI Event Subscription)
# NOTE: Standard protection rule - Microsoft recommends always enabling.
#       If using SCCM/MECM, audit for 60 days before switching to block.
E6DB77E5-3DF2-4CF1-B95A-636979351E5B

# --- Impersonation / Living-off-the-Land ---

# Block use of copied or impersonated system tools
# WHY: Detects and blocks executables that are copies or impostors
#      of Windows system tools (e.g., renamed cmd.exe, powershell.exe).
#      Attackers duplicate or impersonate built-in tools to evade
#      detection rules that monitor original file paths.
# MITRE: T1036 (Masquerading),
#        T1036.003 (Rename System Utilities)
C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB

# --- Server Protection ---

# Block Webshell creation for Servers
# WHY: Prevents creation of web shell scripts on Microsoft Server
#      with the Exchange role. Web shells give attackers persistent
#      remote command execution on a compromised server, enabling
#      data exfiltration, lateral movement, and further compromise.
# MITRE: T1505.003 (Server Software Component: Web Shell)
# APPLIES TO: Windows Server with Exchange role only.
#             Not supported on Windows 10/11 client machines.
A8F5898E-1DC8-49A9-9878-85004B8A61E6

# ---------------------------------------------------------
# WHAT: Verify Defender AV is active and cloud protection is on
# WHY:  ASR rules ONLY function when Defender AV is the primary
#       antivirus (not passive mode). Cloud protection is required
#       for rules that use cloud-based machine learning verdicts.
# ---------------------------------------------------------

# Check AV operational status
# AMRunningMode: "Normal" = primary AV (required for ASR)
#                "Passive" = 3rd-party AV installed (ASR won't work)
#                "SxS Passive" = side-by-side passive mode
# RealTimeProtectionEnabled: Must be True for ASR enforcement
# BehaviorMonitorEnabled: Must be True for behavioral ASR rules
# IoavProtectionEnabled: Internet-origin file scanning (download protection)
Get-MpComputerStatus | Select-Object AMRunningMode,
    RealTimeProtectionEnabled,
    BehaviorMonitorEnabled,
    IoavProtectionEnabled,
    AntivirusEnabled

# Verify cloud-delivered protection settings
# MAPSReporting: 0=Disabled, 1=Basic, 2=Advanced
#   REQUIRED: Must be >= 1; set to 2 for full ASR cloud rule support.
# SubmitSamplesConsent: 0=Prompt, 1=Safe, 2=Never, 3=All
Get-MpPreference | Select-Object MAPSReporting,
    SubmitSamplesConsent

# Check if any ASR rules are already configured on this device
# OUTPUT: Arrays of rule GUIDs and their corresponding action values.
#   Empty arrays = no ASR rules configured yet.
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids,
    AttackSurfaceReductionRules_Actions

# ---------------------------------------------------------
# WHAT: Deploy ASR rules in Audit mode via PowerShell
# WHY:  Audit mode (action value 2) logs what WOULD be blocked
#       without actually blocking it. This is the safe first step
#       to assess impact on legitimate workflows before enforcing.
# ACTION VALUES: 0=Disabled, 1=Block, 2=Audit, 6=Warn
# NOTE: Use Add-MpPreference to append rules; Set-MpPreference
#       would overwrite all existing rules.
# ---------------------------------------------------------

# --- Office Rules ---

# Block Office apps from creating executable content (Audit)
# MITRE: T1204.002 - logs when macros try to drop executables to disk
Add-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 `
    -AttackSurfaceReductionRules_Actions 2

# Block all Office apps from creating child processes (Audit)
# MITRE: T1059 - logs when Word/Excel/PowerPoint spawns cmd, powershell, etc.
Add-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions 2

# Block Office apps from injecting code into other processes (Audit)
# MITRE: T1055 - logs DLL injection / process hollowing from Office macros
Add-MpPreference -AttackSurfaceReductionRules_Ids 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 `
    -AttackSurfaceReductionRules_Actions 2

# Block Office communication application from creating child processes (Audit)
# MITRE: T1137/T1059 - logs when Outlook spawns child processes
Add-MpPreference -AttackSurfaceReductionRules_Ids 26190899-1602-49E8-8B27-EB1D0A1CE869 `
    -AttackSurfaceReductionRules_Actions 2

# Block Win32 API calls from Office macros (Audit)
# MITRE: T1106 - logs when VBA macros call Win32 APIs (e.g., shellcode launch)
Add-MpPreference -AttackSurfaceReductionRules_Ids 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B `
    -AttackSurfaceReductionRules_Actions 2

# --- Adobe Reader Rules ---

# Block Adobe Reader from creating child processes (Audit)
# MITRE: T1204.002 - logs when Adobe Reader spawns cmd, powershell, etc.
Add-MpPreference -AttackSurfaceReductionRules_Ids 7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C `
    -AttackSurfaceReductionRules_Actions 2

# --- Script Rules ---

# Block execution of potentially obfuscated scripts (Audit)
# MITRE: T1027 - logs Base64-encoded or string-concatenated scripts
Add-MpPreference -AttackSurfaceReductionRules_Ids 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC `
    -AttackSurfaceReductionRules_Actions 2

# Block JavaScript or VBScript from launching downloaded executables (Audit)
# MITRE: T1059.005/T1059.007 - logs script-based download cradles
Add-MpPreference -AttackSurfaceReductionRules_Ids D3E037E1-3EB8-44C8-A917-57927947596D `
    -AttackSurfaceReductionRules_Actions 2

# --- Email Rules ---

# Block executable content from email client and webmail (Audit)
# MITRE: T1566.001 - logs when .exe/.dll/.scr/.ps1 run directly from email
Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
    -AttackSurfaceReductionRules_Actions 2

# --- Credential Protection ---

# Block credential stealing from LSASS (Audit)
# MITRE: T1003.001 - logs LSASS memory access by non-system processes
# WHY: Critical rule - detects Mimikatz, ProcDump, comsvcs.dll targeting lsass.exe
Add-MpPreference -AttackSurfaceReductionRules_Ids 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 `
    -AttackSurfaceReductionRules_Actions 2

# --- Ransomware Protection ---

# Use advanced protection against ransomware (Audit)
# MITRE: T1486 - ML-based detection of ransomware file characteristics
Add-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 `
    -AttackSurfaceReductionRules_Actions 2

# --- Exploit Protection ---

# Block abuse of exploited vulnerable signed drivers (Audit)
# MITRE: T1068 - logs when apps try to write vulnerable signed drivers to disk
Add-MpPreference -AttackSurfaceReductionRules_Ids 56A863A9-875E-4185-98A7-B882C64B5CE5 `
    -AttackSurfaceReductionRules_Actions 2

# Block process creations originating from PSExec and WMI commands (Audit)
# MITRE: T1570/T1047 - logs lateral movement via PsExec or WMI remote execution
# WARNING: Incompatible with SCCM/MECM - only use with Intune-managed devices
Add-MpPreference -AttackSurfaceReductionRules_Ids D1E49AAC-8F56-4280-B9BA-993A6D77406C `
    -AttackSurfaceReductionRules_Actions 2

# Block rebooting machine in Safe Mode (Audit)
# MITRE: T1562.009 - logs bcdedit/bootcfg attempts to force Safe Mode reboot
Add-MpPreference -AttackSurfaceReductionRules_Ids 33DDEDF1-C6E0-47CB-833E-DE6133960387 `
    -AttackSurfaceReductionRules_Actions 2

# --- USB / Removable Media ---

# Block untrusted and unsigned processes that run from USB (Audit)
# MITRE: T1091 - logs unsigned executables running from USB/SD cards
Add-MpPreference -AttackSurfaceReductionRules_Ids B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4 `
    -AttackSurfaceReductionRules_Actions 2

# --- Prevalence / Reputation ---

# Block executables unless they meet prevalence, age, or trusted list (Audit)
# MITRE: T1204.002 - logs unknown executables that lack cloud reputation
# NOTE: Requires cloud protection; may flag custom/internal tools
Add-MpPreference -AttackSurfaceReductionRules_Ids 01443614-CD74-433A-B99E-2ECDC07BFC25 `
    -AttackSurfaceReductionRules_Actions 2

# --- Persistence Prevention ---

# Block persistence through WMI event subscription (Audit)
# MITRE: T1546.003 - logs fileless persistence via WMI event consumers
Add-MpPreference -AttackSurfaceReductionRules_Ids E6DB77E5-3DF2-4CF1-B95A-636979351E5B `
    -AttackSurfaceReductionRules_Actions 2

# --- Impersonation / Living-off-the-Land ---

# Block use of copied or impersonated system tools (Audit)
# MITRE: T1036 - logs renamed/duplicated system tools (e.g., renamed cmd.exe)
Add-MpPreference -AttackSurfaceReductionRules_Ids C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB `
    -AttackSurfaceReductionRules_Actions 2

# --- Server Protection ---

# Block Webshell creation for Servers (Audit)
# MITRE: T1505.003 - logs web shell creation on Exchange servers
# NOTE: Only applies to Windows Server with Exchange role
Add-MpPreference -AttackSurfaceReductionRules_Ids A8F5898E-1DC8-49A9-9878-85004B8A61E6 `
    -AttackSurfaceReductionRules_Actions 2

# Verify all 19 rules are configured with their action values
# OUTPUT: Parallel arrays - Ids[0] maps to Actions[0], etc.
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids,
    AttackSurfaceReductionRules_Actions

# ---------------------------------------------------------
# WHAT: Generate test events to validate ASR audit logging
# WHY:  Confirms that audit-mode rules are logging correctly
#       and events flow to both local event logs and the portal.
# ---------------------------------------------------------

# Test ASR: trigger the obfuscated script rule (safe simulation)
# WHY: This creates a benign Base64-encoded PowerShell pattern.
#      The obfuscated script ASR rule (5BEB7EFE) should detect
#      the FromBase64String + Invoke-Expression pattern and log
#      an audit event (Event ID 1122) in the Defender event log.
# NOTE: The decoded string is simply 'Write-Host "ASR Test Successful"'
$testCommand = [System.Text.Encoding]::Unicode.GetString(
    [System.Convert]::FromBase64String("VwByAGkAdABlAC0ASABvAHMAdAAgACIAQQBTAFIAIABUAGUAcwB0ACAA
    UwB1AGMAYwBlAHMAcwBmAHUAbAAiAA==")
)
Invoke-Expression $testCommand

# Query the Defender operational event log for ASR events
# Event ID 1121 = ASR rule BLOCKED an action (only in Block mode)
# Event ID 1122 = ASR rule AUDITED an action (logged but not blocked)
# WHY: During initial deployment, you should only see 1122 events.
#      If you see 1121 events, rules may have been set to Block accidentally.
Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" |
    Where-Object { $_.Id -in @(1121, 1122) } |
    Select-Object TimeCreated, Id, Message -First 10

# Event ID 1121 = ASR rule blocked (block mode)
# Event ID 1122 = ASR rule audited (audit mode)

// ---------------------------------------------------------
// WHAT: View all ASR audit events across all devices in 30 days
// WHY:  Gives a complete picture of which ASR rules are firing,
//       on which devices, and what processes triggered them.
// TABLE: DeviceEvents - captures all endpoint security events.
// KEY FIELDS:
//   ActionType: "Asr*" prefix identifies ASR events (e.g., AsrOfficeChildProcess)
//   FileName: The process that was blocked/audited
//   FolderPath: Full path to the blocked file
//   ProcessCommandLine: Full command line of the blocked process
//   InitiatingProcessFileName: The parent process that triggered the rule
//                              (e.g., WINWORD.EXE spawning cmd.exe)
//   AccountName: User context under which the action occurred
// FILTER: "Audit" in AdditionalFields isolates audit-only events
//         (excludes Block events for a clean audit-phase analysis).
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| where AdditionalFields has "Audit"
| project Timestamp, DeviceName, ActionType,
    FileName, FolderPath, ProcessCommandLine,
    InitiatingProcessFileName, AccountName
| order by Timestamp desc

// ---------------------------------------------------------
// WHAT: Identify which ASR rules fire most frequently
// WHY:  High-frequency rules are either catching real attacks
//       (good) or generating noise from legitimate apps (needs
//       exclusions). Use this to prioritize investigation.
// LOGIC: Counts events per ActionType (each maps to one ASR rule).
// OUTPUT: Bar chart - tallest bars need attention first.
//   e.g., AsrOfficeChildProcessAudited firing 5000x in 30 days
//   likely means macros are commonly spawning child processes.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| summarize EventCount = count() by ActionType
| order by EventCount desc
| render barchart

// ---------------------------------------------------------
// WHAT: Find processes most likely to be false positives
// WHY:  LOB apps that legitimately trigger ASR rules need exclusions.
//       This query surfaces processes appearing on multiple devices
//       (DeviceCount) with high frequency (EventCount > 10),
//       which strongly suggests legitimate application behavior.
// LOGIC:
//   dcount(DeviceId) = number of unique devices triggering this process.
//   High DeviceCount + consistent FolderPath = enterprise LOB app.
//   Low DeviceCount + Temp folder path = likely suspicious.
// ACTION: Share results with application owners to confirm legitimate use,
//         then add verified LOB apps to ASR per-rule exclusions.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| summarize EventCount = count(),
    DeviceCount = dcount(DeviceId) by
    ActionType, FileName, FolderPath
| where EventCount > 10
| order by EventCount desc

# ---------------------------------------------------------
# WHAT: Manage ASR per-rule exclusions via PowerShell
# WHY:  Exclusions allow specific trusted applications to bypass
#       ASR rules. Per-rule exclusions (AttackSurfaceReductionOnly)
#       apply to ALL ASR rules on this device. For rule-specific
#       exclusions, use Intune's per-rule exclusion feature.
# IMPORTANT: Every exclusion is a potential attack vector.
#            Use exact file paths, not broad folder exclusions.
# ---------------------------------------------------------

# Add a per-rule exclusion for a verified LOB application
# WHY: This healthcare app legitimately spawns child processes
#      from Office, triggering the Office child process ASR rule.
Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\HealthcareApp\clinical.exe"

# View all currently configured ASR exclusions
# OUTPUT: List of file/folder paths excluded from all ASR rules.
Get-MpPreference | Select-Object AttackSurfaceReductionOnlyExclusions

# Remove an exclusion that is no longer needed
# WHY: Regularly prune exclusions to minimize attack surface gaps.
Remove-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Program Files\OldApp\legacy.exe"

# ---------------------------------------------------------
# WHAT: Transition Phase 1 ASR rules from Audit to Block mode
# WHY:  Phase 1 targets rules with near-zero false positive rates:
#       LSASS credential theft, email executable content, and
#       ransomware protection. These rarely affect legitimate apps.
# ACTION VALUE: 1 = Block (enforced - action is prevented)
#               2 = Audit (logged only, was previous setting)
# NOTE: Use Set-MpPreference (not Add-) to CHANGE an existing rule's mode.
# ROLLBACK: If issues arise, revert to audit: change Actions to 2.
# ---------------------------------------------------------

# Block credential stealing from LSASS (MITRE T1003.001)
# WHY: Mimikatz, ProcDump, and similar tools will be blocked from
#      reading lsass.exe memory. Very few legitimate tools need this access.
Set-MpPreference -AttackSurfaceReductionRules_Ids 9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 `
    -AttackSurfaceReductionRules_Actions 1

# Block executable content from email client and webmail (MITRE T1566.001)
# WHY: Users cannot directly execute .exe/.scr/.bat from email attachments.
Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 `
    -AttackSurfaceReductionRules_Actions 1

# Use advanced protection against ransomware (MITRE T1486)
# WHY: ML-based blocking of files with ransomware characteristics.
Set-MpPreference -AttackSurfaceReductionRules_Ids C1DB55AB-C21A-4637-BB3F-A12568109D35 `
    -AttackSurfaceReductionRules_Actions 1

# Verify updated rule states - confirm Phase 1 rules show action = 1
Get-MpPreference | Select-Object AttackSurfaceReductionRules_Ids,
    AttackSurfaceReductionRules_Actions

# ---------------------------------------------------------
# WHAT: Set Office macro ASR rules to Warn mode
# WHY:  Warn mode (action value 6) shows a dialog to the user
#       when an ASR rule triggers, letting them unblock the action
#       for 24 hours if it's legitimate. Ideal for environments where
#       some departments use macros but you still want protection.
# MITRE: T1059.005 (VBA macro execution)
# ---------------------------------------------------------

# Set Office child process rule to Warn mode (6 = Warn)
# BEHAVIOR: User sees a toast notification when Word/Excel tries to
#           spawn a child process. They can click "Allow" to bypass
#           the block for 24 hours, or let it be blocked.
Set-MpPreference -AttackSurfaceReductionRules_Ids D4F940AB-401B-4EFC-AADC-AD5F3C50688A `
    -AttackSurfaceReductionRules_Actions 6

# Set Office executable content rule to Warn mode
# BEHAVIOR: User is warned when a macro tries to drop an executable file.
Set-MpPreference -AttackSurfaceReductionRules_Ids 3B576869-A4EC-4529-8536-B80A7769E899 `
    -AttackSurfaceReductionRules_Actions 6

# KQL query to monitor how often users bypass warn prompts
# WHY: High bypass rates on specific devices may indicate users
#      routinely dismissing security prompts - consider blocking
#      or adding targeted exclusions instead.
# DeviceEvents
# | where ActionType startswith "Asr"
# | where AdditionalFields has "Warn"
# | summarize WarnCount = count() by DeviceName, ActionType
# | order by WarnCount desc

// ---------------------------------------------------------
// WHAT: Track ASR block events over time as a daily trend
// WHY:  A sudden spike in blocks may indicate an active attack
//       campaign. A gradual decline shows policy effectiveness.
//       Use as a KPI dashboard for security leadership reporting.
// FILTER: "Block" in AdditionalFields = only enforced blocks.
// OUTPUT: Time chart with one line per ASR rule, daily granularity.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| where AdditionalFields has "Block"
| summarize BlockCount = count() by
    bin(Timestamp, 1d), ActionType
| render timechart

// ---------------------------------------------------------
// WHAT: Top 20 most frequently blocked processes by ASR rules
// WHY:  Identifies which executables are being stopped most often.
//       High-count entries in C:\Program Files = likely false positives.
//       High-count entries in C:\Users\*\Temp = likely true positives.
// AffectedDevices (dcount): High device count = widespread app.
//                          Low device count = targeted/isolated event.
// ACTION: Review top results - add confirmed LOB apps to exclusions;
//         investigate unknown executables as potential threats.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(30d)
| where ActionType startswith "Asr"
| where AdditionalFields has "Block"
| summarize BlockCount = count(),
    AffectedDevices = dcount(DeviceId) by
    FileName, FolderPath, ActionType
| order by BlockCount desc
| take 20

// ---------------------------------------------------------
// WHAT: Verify ASR rule coverage - which devices have activity
// WHY:  Devices with zero ASR events may have rules misconfigured,
//       not applied, or the device may be inactive. Cross-reference
//       with device inventory to find coverage gaps.
// LOGIC: dcount(ActionType) = number of distinct rules that fired.
//        LastEvent = when the device last triggered any ASR rule.
// TIME WINDOW: 7 days - short window to catch recent coverage issues.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "Asr"
| summarize RulesTriggered = dcount(ActionType),
    LastEvent = max(Timestamp) by DeviceName
| order by RulesTriggered desc

// ---------------------------------------------------------
// WHAT: Custom detection rule - ASR blocked credential theft
// WHY:  When the LSASS credential theft ASR rule blocks an attempt,
//       it’s a HIGH-CONFIDENCE indicator of active credential harvesting.
//       This is almost never a false positive in production environments.
// MITRE: T1003.001 (OS Credential Dumping: LSASS Memory)
// DETECTION LOGIC: ActionType == "AsrLsassCredentialTheftBlocked" means
//   a non-system process tried to read LSASS memory and was stopped.
// KEY FIELDS:
//   InitiatingProcessFileName = the parent process (e.g., cmd.exe)
//   ProcessCommandLine = exact command used to access LSASS
//   AccountName = user context (check for compromised accounts)
// TRUE POSITIVE: Mimikatz, ProcDump, pypykatz, or custom tools.
// FALSE POSITIVE: Very rare - some legacy monitoring agents.
// FREQUENCY: Run every 1 hour for near-real-time alerting.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(1h)
| where ActionType == "AsrLsassCredentialTheftBlocked"
| project Timestamp, DeviceName, FileName,
    FolderPath, ProcessCommandLine,
    InitiatingProcessFileName,
    InitiatingProcessCommandLine, AccountName
| order by Timestamp desc

// ---------------------------------------------------------
// WHAT: Custom detection rule - ASR blocked ransomware behavior
// WHY:  The ransomware ASR rule (C1DB55AB) uses ML to detect files
//       with ransomware characteristics. A block event means a file
//       was classified as likely ransomware and prevented from executing.
// MITRE: T1486 (Data Encrypted for Impact)
// DETECTION LOGIC: ActionType == "AsrRansomwareBlocked" fires when
//   the ML model's confidence score exceeds the threshold.
// TRUE POSITIVE: Actual ransomware payload blocked pre-execution.
// FALSE POSITIVE: Rare - legitimate file encryption tools (7-Zip, etc.)
//   may occasionally trigger. Verify FileName/FolderPath before excluding.
// RESPONSE: Immediately investigate the device, check for lateral movement.
// ---------------------------------------------------------
DeviceEvents
| where Timestamp > ago(1h)
| where ActionType == "AsrRansomwareBlocked"
| project Timestamp, DeviceName, FileName,
    FolderPath, ProcessCommandLine, AccountName
| order by Timestamp desc

# ---------------------------------------------------------
# WHAT: Validate ASR rule state on the local device and export config
# WHY:  Final validation ensures all rules are in their intended mode
#       (Block, Audit, or Warn) and the config is documented for
#       compliance audits and disaster recovery.
# ---------------------------------------------------------

# Read the current ASR configuration
$rules = Get-MpPreference
$ruleIds = $rules.AttackSurfaceReductionRules_Ids
$ruleActions = $rules.AttackSurfaceReductionRules_Actions

# Map numeric action values to human-readable mode names
# 0 = Disabled (rule is off)
# 1 = Block (enforced, action is prevented)
# 2 = Audit (logged only, action is allowed)
# 6 = Warn (user sees a prompt, can bypass for 24h)
$modeMap = @{ 0 = "Disabled"; 1 = "Block"; 2 = "Audit"; 6 = "Warn" }

# Display each rule GUID and its current enforcement mode
for ($i = 0; $i -lt $ruleIds.Count; $i++) {
    $mode = $modeMap[$ruleActions[$i]]
    Write-Host "Rule: $($ruleIds[$i]). Mode: $mode"
}

# Export the full ASR config to JSON for documentation/audit purposes
# OUTPUT: ASR-Config-Export.json containing rule IDs, actions, and exclusions.
$rules | Select-Object AttackSurfaceReductionRules_Ids,
    AttackSurfaceReductionRules_Actions,
    AttackSurfaceReductionOnlyExclusions |
    ConvertTo-Json | Out-File "C:\Temp\ASR-Config-Export.json"