Glossary
Attack surface reduction (ASR) rules
Microsoft Defender Antivirus behaviour rules that block common malware techniques, such as Office spawning processes or reading LSASS, regardless of file signatures.
Attack surface reduction rules are part of Microsoft Defender Antivirus. Each rule, identified by a GUID, blocks a specific behaviour that malware relies on and legitimate software rarely needs: Office applications creating child processes or executable content, scripts launching downloaded executables, processes reading LSASS memory, persistence through WMI event subscriptions and more.
Rules can be set to disabled, audit, warn or block, through Group Policy, Intune, Configuration Manager or PowerShell (Add-MpPreference). Blocks are logged as event 1121 and audits as event 1122 in the Defender Operational log. They require Defender Antivirus to be the active antivirus with real-time protection on.
See the ASR rules guide.