Attack Surface Reduction is a new security feature of Windows Defender Exploit Guard on Windows 10 that Microsoft introduced in the Fall Creators Update.
Attack Surface Reduction may prevent common actions of malicious software that is run on Windows 10 devices that have the feature enabled.
The feature is rules based, and designed to target actions and behavior that is typically of malware. You may enable rules that block the execution of obfuscated scripts, executable content in mail clients, or Office from spawning child processes.
Attack Surface Reduction is only available if you enable real-time protection in Windows Defender Antivirus.
Attack Surface Reduction rules
The following rules are available in the Windows 10 Fall Creators Update:
- Block execution of (potentially) obfuscated scripts (5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
) - Block executable content in email clients and web mail (BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550)
- Block Office apps from spawning child processes (D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
- Block Office applications from creating executables (3B576869-A4EC-4529-8536-B80A7769E899)
- Block Office applications from injecting data into other processes (75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84)
- Block Win32 imports from Macro code in Office (92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B)
- Impede JavaScript and VBScript to launch executables (D3E037E1-3EB8-44C8-A917-57927947596D)
Configuring Attack Surface Reduction
The Attack Surface Reduction protection can be configured in three different ways:
- Using Group Policy.
- Using PowerShell.
- Using MDM CSP.
Configuring rules using policies
You need to launch the Group Policy editor to get started. Note that the Group Policy editor is not available on Home editions of Windows 10.
Home users may check out Policy Plus which brings policy editing to the edition of Windows 10.
- Tap on the Windows-key, type gpedit.msc and hit the Enter-key to start the Group Policy editor on Windows 10.
- Navigate to Computer Configuration > Administrative Templates > Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction
- Double-click on the policy “Configure Attack surface reduction rules”.
- Set the policy to enabled.
- Setting the policy to enabled activates the “show” button. Click on show to load the “show contents” window.
Show contents is a table that accepts one Attack Surface Reduction rule per row. Value name is the ID that is listed under rules above in the brackets.
Value accepts the following input:
- 0 = disabled. The rule is not active.
- 1 = enabled. The rule is active, and block mode is activated.
- 2 = audit mode. Events will be recorded, but the actual rule is not enforced.
Configuring rules using PowerShell
You may use PowerShell to configure rules.
- Tap on the Windows-key, type PowerShell, hold down the Shift-key and the Ctrl-key, and load the PowerShell entry with a click.
Use the following command to add a blocking mode rule:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Enabled
Use the following command to add an audit mode rule:
Read also: Microsoft extends support of Windows 10 version 1607 to 2023
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions AuditMode
Use the following command to set a rule to disabled:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Disabled
You can combine multiple rules in a single command by separating each rule with a comma, and by listing states individually for each rule. Example:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID>, <rule ID 2>, <rule ID 3> -AttackSurfaceReductionRules_Actions Disabled, Enabled, Enabled
Note: you can use Set-MpPreference or Add-MpPreference. The Set command will always overwrite the existing set of rules while the Add command adds to it without overwriting existing rules.
You can display the set of rules using the Get-MpPreference command.
Attack Surface Reduction Events
Log entries are created whenever you change rules, and when events fire rules in audit mode or in block mode.
- Download the Exploit Guard Evaluation Package from Microsoft.
- Extract the content of the archive to the local system so that asr-events.xml is accessible on the system.
- Tap on the Windows-key, type Event Viewer and select the item from the list of suggestions to load the Event Viewer interface.
- Select Action > Import custom view when the interface is open.
- Select the asr-events.xml file that you extracted previously.
- Select ok when the “import custom view file” window opens. You may add a description if you want.
The new view is listed under Custom Views afterwards that shows the following events:
- Event ID 1121 — blocking mode events
- Event ID 1122 — audit mode events
- Event ID 5007 — changing settings events.
Excluding files and folders
You can exclude files or folders so that the excluded items are not evaluated by Attack Surface Reduction rules.
- Group Policy: Go to Computer configuration > Administrative templates > Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack surface reduction > Exclude files and paths from Attack surface reduction Rules. Set the policy to enabled, click on the show button, and add files or folders (folder path or resource, e.g. c:Windows in the value name, and 0 in the value field of each column.
- PowerShell: Use the command Add-MpPreference -AttackSurfaceReductionOnlyExclusions “<fully qualified path or resource>” to add files or folders to the exclusions list.
Microsoft Resources
Check out the following resources on Microsoft’s website for additional information on Attack Surface Reduction:
- Enable Attack surface reduction
- Customize Attack surface reduction
- Reduce attack surfaces with Windows Defender Exploit Guard
- Windows Defender Exploit Guard
- Set-MpPreference documentation
- Add-MpPreference documentation
- Get-MpPreference documentation