(147) Microsoft Intune - Configure Available Attack Surface Reduction Rules with Exceptions

As our company generally deploys CIS Benchmark controls to customers as a baseline or Essential 8 (ACSC), as part of CIS baselines we also deploy Attack Surface Reduction Rules.

What is Attack Surface Reduction Rules? 

Attack surfaces are all the places where your organization is vulnerable to cyber threats and attacks. An attacker could compromise your organization’s devices or networks. To minimize the risk that an attacker could compromise your device, you must implement security measures e.g., Attack Surface Reduction rules, Network protection, application control, etc.  See Microsoft documentation for all the security measures.

There are five ways of deploying Attack Surface Reduction Rules:

1) Attack Surface Reduction Rules via Endpoint protection

Endpoint protection configuration profile can be used to control the security of Windows devices. The category Microsoft Defender Exploit Guard contains an Attack Surface Reduction group and contains nearly all currently available ASR rules.

2) Attack Surface Reduction Rules via custom configuration profile A custom configuration profile can be used to configure settings that are available in Configuration Service Provider (CSP). CSP also includes all ASR rules. ASR rules and exclusions need to be set via custom OMA-URI’s.

3) Attack Surface Reduction Rules via MDM Security Baseline

Security baselines are Microsoft-recommended configuration settings. These settings are based on feedback from Microsoft security engineering teams, product groups, partners, and customers. A security baseline includes a group of Microsoft Defender settings. The Security Baseline contains nearly all currently available ASR rules.

4) Attack Surface Reduction Rules via Endpoint Security Attack Surface Reduction rules

The Attack Surface Reduction rules profile can be used to configure the Attack Surface Reduction rules and contains nearly all currently available ASR rules.

5) Attack Surface Reduction Rules via PowerShell script

PowerShell is a cross-platform task automation solution made up of a command-line shell, a scripting language, and a configuration management framework. We can use a PowerShell script to set all the available ASR rules.

How to create OMA-URI Profile for ASR Rules?

Today we will create a rule using OMA-URI which is the 2nd option listed above. Navigate to https://intune.microsoft.com/ > Devices > Configuration > Create > New Policy > Platform: Windows 10 and later > Profile type: Templates > Custom

Under Basics, enter Name of Profile: ASR Rules

Under Configuration Settings > select Add

Name: ASR Rules

Description: All ASR Rules Enabled

OMA-URI: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules

Data Type: String

Value:

75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84=1|3b576869-a4ec-4529-8536-b80a7769e899=1|d4f940ab-401b-4efc-aadc-ad5f3c50688a=1|92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b=1|5beb7efe-fd9a-4556-801d-275e5ffc04cc=1|d3e037e1-3eb8-44c8-a917-57927947596d=1|9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2=1|d1e49aac-8f56-4280-b9ba-993a6d77406c=1|b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4=1|01443614-cd74-433a-b99e-2ecdc07bfc25=1|be9ba2d9-53ea-4cdc-84e5-9b1eeee46550=1|c1db55ab-c21a-4637-bb3f-a12568109d35=1|7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c=1|26190899-1602-49e8-8b27-eb1d0a1ce869=1|e6db77e5-3df2-4cf1-b95a-636979351e5b=1|56a863a9-875e-4185-98a7-b882c64b5ce5=1

Under Review + Create, review the settings then select Create.

How to create OMA-URI Profile for ASR Exclusion?

Navigate to https://intune.microsoft.com/ > Devices > Configuration > Create > New Policy > Platform: Windows 10 and later > Profile type: Templates > Custom

Under Basics, enter Name of Profile: ASR Rules Exclusion

Under Configuration Settings > select Add

Name: ASR Rules Exclusion

Description: Exclusions

OMA-URI: ./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions

Data Type: String

Value:

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe | C:\Program Files (x86)\Zoiper5\Uninstall.exe

Under Review + create, review the settings and select Create.

To test your ASR rules, navigate to Event Viewer then DeviceManagement-Enteprise-Diagnostics-Provide -> Admin