Attack surface reduction rules

Concept

Rules in Microsoft Defender for Endpoint that block risky software behaviors commonly abused by malware, such as macros in Office files downloaded from the internet.

Title graphic: Attack surface reduction rules (Concept)

Type	Concept
Documentation	learn.microsoft.com/defender-endpoint/attack-surface-reduction-rules-overview

Articles about Attack surface reduction rules (2)

Microsoft Defender: 엔드포인트용 공격 표면 감소 규칙
2026-03-06 · Mirko Peters
엔드포인트를 공격 표면 감소 규칙으로 강화하세요. 고급 KQL 쿼리를 사용해 ASR 규칙의 효과를 감사하고, 탐지 성능을 높이고 제외 항목을 세밀하게 조정하세요.
Microsoft Defender: Attack Surface Reduction Rule for Endpoint
2026-03-06 · Mirko Peters
Harden endpoints with Attack Surface Reduction rules. Audit ASR rule effectiveness using advanced KQL queries for improved detection and exclusion tuning.

Glossary

Community wiki

Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.

Experts and companies for this topic

Nobody has listed this topic yet. Add it to your profile.

Sources

Documentation: learn.microsoft.com/defender-endpoint/attack-surface-reduction-rules-overview
Feed for this topic (RSS): entity/attack-surface-reduction-rules/feed.xml
Articles on this topic: 2

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-06