Attack Surface Reduction is a new security feature of Windows Defender Exploit Guard on Windows 10 that Microsoft introduced in the Fall Creators Update.
Attack Surface Reduction may prevent common actions of malicious software that is run on Windows 10 devices that have the feature enabled.
The feature is rules based, and designed to target actions and behavior that is typically of malware. You may enable rules that block the execution of obfuscated scripts, executable content in mail clients, or Office from spawning child processes.
Attack Surface Reduction is only available if you enable real-time protection in Windows Defender Antivirus.
The following rules are available in the Windows 10 Fall Creators Update:
The Attack Surface Reduction protection can be configured in three different ways:
You need to launch the Group Policy editor to get started. Note that the Group Policy editor is not available on Home editions of Windows 10.
Home users may check out Policy Plus which brings policy editing to the edition of Windows 10.
Show contents is a table that accepts one Attack Surface Reduction rule per row. Value name is the ID that is listed under rules above in the brackets.
Value accepts the following input:
You may use PowerShell to configure rules.
Use the following command to add a blocking mode rule:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Enabled
Use the following command to add an audit mode rule:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions AuditMode
Use the following command to set a rule to disabled:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Disabled
You can combine multiple rules in a single command by separating each rule with a comma, and by listing states individually for each rule. Example:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID>, <rule ID 2>, <rule ID 3> -AttackSurfaceReductionRules_Actions Disabled, Enabled, Enabled
Note: you can use Set-MpPreference or Add-MpPreference. The Set command will always overwrite the existing set of rules while the Add command adds to it without overwriting existing rules.
You can display the set of rules using the Get-MpPreference command.
Log entries are created whenever you change rules, and when events fire rules in audit mode or in block mode.
The new view is listed under Custom Views afterwards that shows the following events:
You can exclude files or folders so that the excluded items are not evaluated by Attack Surface Reduction rules.
Check out the following resources on Microsoft's website for additional information on Attack Surface Reduction:
If you like our content, and would like to help, please consider making a contribution: