Implementing Attack Surface Reduction Rules

Question

195642-asr-detections.txt

Hi All -

My security recommendations are full of "Implement ASR"... etc within Microsoft Security. I see the huge benefit here so I started the process. I enabled all GUID's that I could find and placed them into audit mode. I then created a custom view within Event Viewer on several PC's to monitor detections. Links below for reference:

https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction?view=o365-worldwide
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/overview-attack-surface-reduction?view=o365-worldwide

I implemented these via GPO and Event Viewer has a ton of entries. To me, a bunch of false positives and even after reading all of the documentation, I don't know exactly what to whitelist without potentially adding vulnerabilities. Attached are the majority of entries within several computers and they all look to be false positives. For the ones that mention a registry entry, would they actually block anything or is it just informational? If they block something, how would I know what to make an exception on? A lot mention lsass.exe and spoolsv.exe which I know are required for end users to work, but I also know they can be vulnerable. What would these do if in block mode instead of audit?

I appreciate any help as I am just learning ASR and while there is documentation on it, it is not where it needs to be. If someone could provide more resources for me to understand this better, much appreciated!!

Answer 1

Hi @BmoreOs
you are correct, some ASR rules can require significant tuning in blocking mode.
My approach is set the rules that don't give you trouble in blocking mode and leave the rest in audit.
Then use your SIEM (Sentinel) to track and filter these 'anomalies'.
As you can see, some ASR rules only trust Microsoft signed processes, so they'll only be practical for blocking in a perfect world.

If this helps please accept my solution and upvote. Or just have a nice day.