ASR Rules - reference for suggested settings

[ee61re]

When I was looking into ASR a year or so ago, I found this article from 2021 - https://blog.palantir.com/microsoft-defender-attack-surface-reduction-recommendations-a5c7d41c3cf8

I've implemented based on that in several tenants since, with good results.

Worth a review?

[SkipToTheEndpoint]

Will be addressed in v3.3 🙂

[xenadmin]

@SkipToTheEndpoint Is there any document or readme where you describe, why you designed the Win - OIB - Attack Surface Reduction - D - ASR Rules (L2) - v3.3 policy like you did? I think I see a pattern there and would like to understand your suggestions better.

Background: Our current ASR rule is a bit stricter, and I know, yours is not meant to be used 1:1, but I still would like to hear, why it's not as strict as it might be.

For example: Block credential stealing from the Windows local security authority subsystem

[SkipToTheEndpoint]

Semi-caution, more than anything.

Apply the MS Defender baseline and it'll ram everything into Block which (given how most people yeet out a baseline without testing) is a recipe for disaster.
The LSASS rule can cause a lot of potentially false positives and I'd generally approach it with caution as mentioned in the CHANGELOG.

That said, if you've already got stricter rules in place and experience no issues, stick with them!

[ak47uk]

Dropbox is an an example of an LSASS false positive, I excluded "C:\Program Files (x86)\Dropbox*\Dropbox.exe" on that policy.