Configure Attack Surface Reduction in Windows 10
Attack Surface Reduction is a new security feature of Windows Defender Exploit Guard on Windows 10 that Microsoft introduced in the Fall Creators Update.
Attack Surface Reduction may prevent common actions of malicious software that is run on Windows 10 devices that have the feature enabled.
The feature is rules based, and designed to target actions and behavior that is typically of malware. You may enable rules that block the execution of obfuscated scripts, executable content in mail clients, or Office from spawning child processes.
Attack Surface Reduction is only available if you enable real-time protection in Windows Defender Antivirus.
Attack Surface Reduction rules
The following rules are available in the Windows 10 Fall Creators Update:
- Block execution of (potentially) obfuscated scripts (5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
- Block executable content in email clients and web mail (BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550)
- Block Office apps from spawning child processes (D4F940AB-401B-4EFC-AADC-AD5F3C50688A)
- Block Office applications from creating executables (3B576869-A4EC-4529-8536-B80A7769E899)
- Block Office applications from injecting data into other processes (75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84)
- Block Win32 imports from Macro code in Office (92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B)
Configuring Attack Surface Reduction
The Attack Surface Reduction protection can be configured in three different ways:
- Using Group Policy.
- Using PowerShell.
- Using MDM CSP.
Configuring rules using policies
You need to launch the Group Policy editor to get started. Note that the Group Policy editor is not available on Home editions of Windows 10.
Home users may check out Policy Plus which brings policy editing to the edition of Windows 10.
- Tap on the Windows-key, type gpedit.msc and hit the Enter-key to start the Group Policy editor on Windows 10.
- Navigate to Computer Configuration > Administrative Templates > Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack Surface Reduction
- Double-click on the policy "Configure Attack surface reduction rules".
- Set the policy to enabled.
- Setting the policy to enabled activates the "show" button. Click on show to load the "show contents" window.
Show contents is a table that accepts one Attack Surface Reduction rule per row.Â Value name is the ID that is listed under rules above in the brackets.
Value accepts the following input:
- 0 = disabled. The rule is not active.
- 1 = enabled. The rule is active, and block mode is activated.
- 2 = audit mode. Events will be recorded, but the actual rule is not enforced.
Configuring rules using PowerShell
You may use PowerShell to configure rules.
- Tap on the Windows-key, type PowerShell, hold down the Shift-key and the Ctrl-key, and load the PowerShell entry with a click.
Use the following command to add a blocking mode rule:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Enabled
Use the following command to add an audit mode rule:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions AuditMode
Use the following command to set a rule to disabled:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Disabled
You can combine multiple rules in a single command by separating each rule with a comma, and by listing states individually for each rule. Example:
Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID>, <rule ID 2>, <rule ID 3> -AttackSurfaceReductionRules_Actions Disabled, Enabled, Enabled
Note: you can use Set-MpPreference or Add-MpPreference. The Set command will always overwrite the existing set of rules while the Add command adds to it without overwriting existing rules.
You can display the set of rules using the Get-MpPreference command.
Attack Surface Reduction Events
Log entries are created whenever you change rules, and when events fire rules in audit mode or in block mode.
- Download the Exploit Guard Evaluation Package from Microsoft.
- Extract the content of the archive to the local system so that asr-events.xml is accessible on the system.
- Tap on the Windows-key, type Event Viewer and select the item from the list of suggestions to load the Event Viewer interface.
- Select Action > Import custom view when the interface is open.
- Select the asr-events.xml file that you extracted previously.
- Select ok when the "import custom view file" window opens. You may add a description if you want.
The new view is listed under Custom Views afterwards that shows the following events:
- Event ID 1121 -- blocking mode events
- Event ID 1122 -- audit mode events
- Event ID 5007 -- changing settings events.
Excluding files and folders
You can exclude files or folders so that the excluded items are not evaluated by Attack Surface Reduction rules.
- Group Policy: Go to Computer configuration > Administrative templates > Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Attack surface reduction > Exclude files and paths from Attack surface reduction Rules. Set the policy to enabled, click on the show button, and add files or folders (folder path or resource, e.g. c:\Windows in the value name, and 0 in the value field of each column.
- PowerShell: Use the command Add-MpPreference -AttackSurfaceReductionOnlyExclusions "<fully qualified path or resource>" to add files or folders to the exclusions list.
Check out the following resources on Microsoft's website for additional information on Attack Surface Reduction:
- Enable Attack surface reduction
- Customize Attack surface reduction
- Reduce attack surfaces with Windows Defender Exploit Guard
- Windows Defender Exploit Guard
- Set-MpPreference documentation
- Add-MpPreference documentation
- Get-MpPreference documentation
I don’t understand why Microsoft doesn’t make system hardening the default in Windows. Most people won’t comprehend how to change settings in Defender.
With just two exceptions (gaming and education) MS seems to be turning its focus to enterprise and away from the consumer market. KB4046355 on Win10 v.1709 made Media Player an on-demand feature. I believe that’s to mitigate any vulnerability in Win10 that might threaten enterprise installations (i.e. system hardening). System hardening may become the default.
Beware: Update KB4046355 removes Windows Media Player
MS’s 2018 Q1 financial report is due 26 Oct. It will be an interesting read.
Your work on this appears to be outstanding, but how many Home users will spend the time to implement this, and risk troubleshooting the consequence of an implementation error that might not show up for days or weeks later? This process may be better than using the old EMET, but needs an automation and rollback process to make changes controllable and incrementally reversible.
The rules, for me, to consider are:
– Block execution of (potentially) obfuscated scripts
Another chapter for your book, Martin. :)
Maybe for a security book ;)
Does Attack Surface Reduction require Windows Defender Antivirus.
I mean does Attack Surface Reduction work with third party security software.
Do new security features introduced in the Fall Creators Update require Windows Defender Antivirus.
Windows Defender and Real-Time Protection needs to be enabled. It won’t work otherwise.
Awesome article, thanks a lot Martin !
This is the biggest problem:
“Attack Surface Reduction is only available if you enable real-time protection in Windows Defender Antivirus.”
Will there be any resources left for other software You want to run ?
Tried Defender in 8.1 and it sucked out resources, even with a new computer at that time…..
Excellent review, thank you !
No No No No No… Show an example of the table with values for the GPO… Don’t just show a blank table… that’s useless.