Attack surface reduction rules

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• AsrUntrustedExecutableAudited
• AsrUntrustedExecutableBlocked
• Credential Guard

Requirements, exceptions and scope

• Operating system support for ASR rulesException3 conditions2 passages

  Rule name: Block executable files from running unless they meet a prevalence, age, or trusted list criterion; Windows 11 or later: Y; Windows 10: 1803…

• Deployment method support for ASR rulesException1 condition1 passage
• Alerts and notifications from ASR rule actionsException3 conditions3 passages
• Block abuse of exploited vulnerable signed drivers (Device)ScopeRecommendation2 passages
• Block credential stealing from the Windows local security authority subsystemRequirementExceptionRecommendation2 conditions3 passages
  Credential Guard
• Block Adobe Reader from creating child processesException2 conditions2 passages
• Block all Office applications from creating child processesException1 condition1 passage
• Block executable content from email client and webmailException2 conditions2 passages
• Block executable files from running unless they meet a prevalence, age, or trusted list criterionRequirementException15 conditions12 passages
  AsrUntrustedExecutableAuditedAsrUntrustedExecutableBlocked
• Block execution of potentially obfuscated scriptsRequirementException2 passages
• Block JavaScript or VBScript from launching downloaded executable contentException2 conditions2 passages
• Block Office applications from injecting code into other processesRequirementExceptionScope2 conditions3 passages
• Block Office communication application from creating child processesException1 condition1 passage
• Block untrusted and unsigned processes that run from USBScope1 passage
• Use advanced protection against ransomwareRequirement1 passage

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.