Attack surface reduction (ASR) rules are enabled in block mode

Overview

Attack surface reduction rules block the specific behaviors that commodity malware, fileless threats, and human-operated intrusion sets reuse across campaigns. Each rule targets a narrow, well-documented execution pattern such as document applications creating child processes, script interpreters launching downloaded content, unsigned binaries performing bulk file operations, or processes attempting to read credential stores. When the rules are not set to block mode, an adversary who delivers a payload to an endpoint can exercise these patterns freely because no preventive control intervenes at the behavior layer. Audit mode records the activity but does not stop it, which means the security operations team sees the evidence only after the damage is done. The risk compounds because ASR rules operate as a set: leaving even a small number of rules in audit or disabled state creates predictable gaps that an attacker can target, knowing that the specific behavior will not be blocked. If you are new to ASR, Microsoft recommends starting in audit mode to understand the impact in your environment before switching rules to block - audit mode is a starting point, not the end state.

Remediation

• Attack surface reduction rules deployment
• Plan attack surface reduction rules deployment
• Test attack surface reduction rules
• Enable attack surface reduction rules
• Attack surface reduction rules reference

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	High
Effort to fix	Medium
Impact on users	Medium
Pillar	SecOps
Category	Endpoint threat protection
Product	Intune
Feature	Endpoint security
Area	Devices and endpoints
ATT&CK	T1204.002 Malicious File, T1059 Command and Scripting Interpreter, T1003.001 LSASS Memory
Licence	WINDEFATP
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.