Implement Windows 10 Security Enhancements

 

Understand Attack Surface Reduction

Attack Surface Reduction is all about hardening the places where a threat is likely to attack and whenever you are performing alert investigations, you should also know the events generated by the Attack Surface Reduction on the host, which might provide forensics evidence.

The following is a list of the Attack Surface Reduction components:

Solution	Description
Attack Surface Reduction	Reduce vulnerabilities (attack surfaces) in your applications with intelligent rules that helps stop malware.(Requires Microsoft Defender Antivirus).
Hardware-based isolation	Protect and maintain the integrity of a system as it starts and while it’s running, validate system integrity through local as well as remote attestation, and use container isolation for Microsoft Edge to help guard against malicious websites.
Application control	Use application control so that your applications must earn trust in order to run.
Exploit protection	Help protect the operating systems and apps your organization uses from being exploited. It also works with third-party antivirus solutions.
Network protection	Extend protection to your network traffic and connectivity on your organization’s devices. (Requires Microsoft Defender Antivirus).
Web protection	Secure your devices against web threats and helps you regulate the unwanted content.
Control folder access	Helps prevent malicious and suspicious apps from making changes to the files in your key system folders. (Requires Microsoft Defender Antivirus).
Network firewall	Prevent unauthorized traffic from flowing to or from your organization’s devices with the two-way network traffic filtering.

 

Enable attack surface reduction rules

Reducing your attack surface means protecting your organization's devices and network, which leaves the attackers with fewer ways to perform attacks. Attack Surface Reduction rules target certain software behaviors that are often abused by the attackers, such as:

• Launching executable files and scripts that attempt to download or run files.
• Running obfuscated or otherwise suspicious scripts.
• Performing behaviors that apps don't usually initiate during normal day-to-day work. 

Such software behavior are sometimes seen in the legitimate applications; however, these behaviors are often considered risky because they are commonly abused by malware, but the Attack Surface Reduction rules can constrain risky behaviors and help keep your organization safe. 

Each Attack Surface Reduction rule contains one of the three settings:

• Not configured- Disable the attack surface reduction rule.
• Block- Enable the attack surface reduction rule.
• Audit- Evaluate how the attack surface reduction rule would impact your organization if enabled.

Attack surface reduction rules

Attack Surface Reduction rules currently supports all of the rules below: 

• Block executable content from email client and webmail.
• Block all Office applications from creating child processes.
• Block Office applications from creating executable content.
• Block JavaScript and VBScript from launching downloaded executable content.
• Block execution of potentially obfuscated scripts.
• Block Win32 API calls from Office macro.
• Use advanced protection against ransomware.
• Block credential stealing from Windows local security authority subsystem (Isass.exe).
• Block process creations originating from PSExec and WMI commands.
• Block untrusted and unsigned processes that run from USB.
• Block executable files from running unless they meet a prevalence, age, or trusted list criteria.
• Block Office communication applications from creating child processes.
• Block Adobe Reader from creating child processes.
• Block persistence through WMI event subscription. 

Exclude files and folders from the attack surface reduction rules

It specify that even if an attack surface reduction rule determines a particular file or folder contains malicious behavior, it will not block the file from running, which means that the potentially unsafe files are allowed to run and infect your devices.

You can easily specify individual files or folders, but you can't specify which rules the exclusion apply to. An exclusion is applied only when the excluded application or service starts. 

Audit mode for evaluation

You can use an audit mode to evaluate how the attack surface reduction rules would impact your organization if they were enabled. It's the best practice to run all the rules in the audit mode first so you can easily understand their impact on your line-of-business applications and by monitoring the audit data and adding exclusions for the necessary applications, you can deploy attack surface reduction rules without impacting productivity.

Configure attack service reduction rules

You can set these rules for the devices running any of the following editions and versions of Windows:

• Windows 10 Pro, version 1709 or later
• Windows 10 Enterprise, version 1709 or later
• Windows Server, version 1803 (semi-annual channel) or later
• Windows Server 2019

You can enable attack surface reduction rules by using any of these methods:

• Microsoft Intune
• Mobile Device Management (MDM)
• Microsoft Endpoint Configuration Manager
• Group Policy
• PowerShell 

Enterprise-level management such as Intune or Microsoft Endpoint Configuration Manager is recommended that can overwrite any conflicting Group Policy or PowerShell settings on startup.