Windows Defender attack surface reduction and exploit protection features

To support me, you can subscribe to the channel, share and like the videos, disable your ad blocker or make a donation. Thank you!

Hello,

A video on Windows Defender’s attack surface reduction and Exploit protection features

# List of rules and documentation on reducing the attack surface
https://learn.microsoft.com/fr-fr/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#asr-rule-to-guid-matrix

Exploit protection documentation
https://learn.microsoft.com/fr-fr/microsoft-365/security/defender-endpoint/exploit-protection?view=o365-worldwide

Powershell code for attack surface reduction and and Exploit protection for Windows Defender

#Enable all attack surface reduction rules (list of rules).
$rules = @("be9ba2d9-53ea-4cdc-84e5-9B1eeee46550"
            "d4f940ab-401b-4efc-aadc-ad5f3c50688a"
            "3b576869-a4eC-4529-8536-b80a7769e899"
            "75668c1f-73b5-4Cf0-bb93-3ecf5cb7cc84"
            "d3e037e1-3eb8-44C8-a917-57927947596d"
            "5beb7efe-fd9A-4556-801d-275e5ffc04cc"
            "92e97fa1-2edf-4476-bdd6-9dd0B4dddc7b"
            "01443614-cd74-433a-b99e-2ecdc07bfc25"
            "c1db55ab-c21a-4637-bb3f-a12568109d35"
            "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2"
            "d1e49aac-8f56-4280-b9ba-993a6d77406c"
            "b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4"
            "26190899-1602-49e8-8b27-eb1d0a1ce869"
            "7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c"
            "e6db77e5-3df2-4cf1-b95a-636979351e5b"
            "56a863a9-875e-4185-98a7-b882c64b5ce5"
)
Add-MpPreference -AttackSurfaceReductionRules_Ids $rules -AttackSurfaceReductionRules_Actions (0..($rules.Count -1) | % {"enabled"})

#Disable
Add-MpPreference -AttackSurfaceReductionRules_Ids $rules -AttackSurfaceReductionRules_Actions (0..($rules.Count -1) | % {"disabled"})

#Add an exclusion for attack surface reduction
Add-MpPreference -AttackSurfaceReductionOnlyExclusions "c:\vm"

#Display attack surface reduction parameters (1: Enabled, 0: Disabled)
$FormatEnumerationLimit = 20
Get-MpPreference | fl attack*

#Display list of rules
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids
# Powershell command to test the rule Block process creation from PSExec and WMI defender commands ASR advanced options
Invoke-CimMethod -ClassName Win32_Process -MethodName Create -Arguments @{CommandLine='Notepad.exe'}

Windows Defender attack surface reduction and exploit protection features

Powershell code for attack surface reduction and and Exploit protection for Windows Defender

Video : Windows Defender attack surface reduction and exploit protection features

Related links

Windows Defender attack surface reduction and exploit protection features

Managing NTFS file system and share security rights

How to add and change languages in Windows 10 and Windows 11

Services and the services console on Windows

The difference between a printer and a printing device

How to delete personal metadata from Windows files

Follow me on

Support me

Last content

Tags