Skip to content
WindowsHardening

Area 03 / 12

Attack Surface Reduction

Attack surface reduction (ASR) rules stop specific, commonly abused behaviours regardless of the file hash, which is why they catch new malware on day one. This area explains every rule, how to roll them out in audit mode, how to read the events and how to exclude the rare legitimate collision without gutting the protection.

Start the path

Learning path

0/4 done
  1. 01Attack surface reduction rules: GUIDs and safe rolloutA practical reference to Microsoft Defender ASR rules: what each rule blocks, its GUID, which to enforce first, audit-mode rollout, event IDs and exclusions that don't gut protection.
  2. 02Exploit protection: system and per-app mitigationsConfigure Windows exploit protection, the EMET successor: system defaults, per-app mitigations, audit mode, XML export/import and GPO or Intune deployment.
  3. 03Harden Microsoft Office: macros, OLE and add-insLock down Microsoft 365 Apps: block internet macros, disable XLM, scan VBA with AMSI, keep Protected View on, require signed add-ins, stop OLE and DDE.
  4. 04Harden Microsoft Edge with Group Policy and IntuneHarden Microsoft Edge by policy: enforced SmartScreen, an extension allowlist, enhanced security mode, download restrictions and fast forced updates.