Modifica

Troubleshoot attack surface reduction rules

  • Articolo

Applies to:

Want to experience Defender for Endpoint? Sign up for a free trial.

When you use attack surface reduction rules you might run into issues, such as:

  • A rule blocks a file, process, or performs some other action that it shouldn't (false positive)
  • A rule doesn't work as described, or doesn't block a file or process that it should (false negative)

There are four steps to troubleshooting these problems:

  1. Confirm prerequisites
  2. Use audit mode to test the rule
  3. Add exclusions for the specified rule (for false positives)
  4. Submit support logs

Confirm prerequisites

Attack surface reduction rules only work on devices with the following conditions:

If these prerequisites are met, proceed to the next step to test the rule in audit mode.

Use audit mode to test the rule

Follow these instructions in Use the demo tool to see how attack surface reduction rules work to test the specific rule you're encountering problems with.

  1. Enable audit mode for the specific rule you want to test. Use Group Policy to set the rule to Audit mode (value: 2) as described in Enable attack surface reduction rules. Audit mode allows the rule to report the file or process, but allows it to run.

  2. Perform the activity that is causing an issue (for example, open or execute the file or process that should be blocked but is being allowed).

  3. Review the attack surface reduction rule event logs to see if the rule would block the file or process if the rule were set to Enabled.

If a rule isn't blocking a file or process that you're expecting it should block, first check if audit mode is enabled.

Audit mode might be enabled for testing another feature, or by an automated PowerShell script, and might not be disabled after the tests were completed.

If you've tested the rule with the demo tool and with audit mode, and attack surface reduction rules are working on preconfigured scenarios, but the rule isn't working as expected, proceed to either of the following sections based on your situation:

  1. If the attack surface reduction rule is blocking something that it shouldn't block (also known as a false positive), you can first add an attack surface reduction rule exclusion.

  2. If the attack surface reduction rule isn't blocking something that it should block (also known as a false negative), you can proceed immediately to the last step, collecting diagnostic data and submitting the issue to us.

Add exclusions for a false positive

If the attack surface reduction rule is blocking something that it shouldn't block (also known as a false positive), you can add exclusions to prevent attack surface reduction rules from evaluating the excluded files or folders.

To add an exclusion, see Customize Attack surface reduction.

Important

You can specify individual files and folders to be excluded, but you cannot specify individual rules. This means any files or folders that are excluded will be excluded from all ASR rules.

Report a false positive or false negative

Use the Microsoft Security Intelligence web-based submission form to report a false negative or false positive for network protection. With a Windows E5 subscription, you can also provide a link to any associated alert.

Collect diagnostic data for file submissions

When you report a problem with attack surface reduction rules, you're asked to collect and submit diagnostic data that can be used by Microsoft support and engineering teams to help troubleshoot issues.

  1. Open an elevated command prompt and change to the Windows Defender directory:

    cd "c:\program files\Windows Defender"

  2. Run this command to generate the diagnostic logs:

    mpcmdrun -getfiles

  3. By default, they're saved to C:\ProgramData\Microsoft\Windows Defender\Support\MpSupportFiles.cab. Attach the file to the submission form.

Tip

Do you want to learn more? Engage with the Microsoft Security community in our Tech Community: Microsoft Defender for Endpoint Tech Community.