Attack surface reduction rules

Concept

Rules in Microsoft Defender for Endpoint that block risky software behaviors commonly abused by malware, such as macros in Office files downloaded from the internet.

Title graphic: Attack surface reduction rules (Concept)

Typ	Concept
Dokumentacja	learn.microsoft.com/defender-endpoint/attack-surface-reduction-rules-overview

Articles about Attack surface reduction rules (2)

Microsoft Defender: reguła redukcji powierzchni ataku dla punktów końcowych
2026-03-06 · Mirko Peters
Wzmacniaj punkty końcowe za pomocą reguł redukcji powierzchni ataku (ASR). Audytuj skuteczność reguł ASR, korzystając z zaawansowanych zapytań KQL, aby poprawić wykrywanie i dostra
Microsoft Defender: Attack Surface Reduction Rule for Endpoint
2026-03-06 · Mirko Peters
Harden endpoints with Attack Surface Reduction rules. Audit ASR rule effectiveness using advanced KQL queries for improved detection and exclusion tuning.

Słownik

Community wiki

Short info above, community knowledge below: add practical tips, examples or corrections. New contributions are reviewed first; trusted members publish directly.

Eksperci i firmy w tym temacie

Nikt jeszcze nie wskazał tego tematu. Dodaj go do swojego profilu.

Sources

Documentation: learn.microsoft.com/defender-endpoint/attack-surface-reduction-rules-overview
Feed for this topic (RSS): entity/attack-surface-reduction-rules/feed.xml
Articles on this topic: 2

Maintained by Mirko Peters (Microsoft MVP) · Last updated: 2026-11-06