← All cheat sheets

DEFENDER ASR RULES AND APP CONTROL

Plain-text reference · 12 KB. Read it, search it (Ctrl-F) or print it.

Attack surface reduction (ASR) rules, controlled folder access and network
protection in Microsoft Defender, and application allow-listing with App
Control for Business and AppLocker: rule GUIDs, modes, PowerShell, event
IDs and hunting queries. Roll out in Audit first, read the events, add
exclusions, then enforce. ASR rules are a Windows feature: not available on
Linux or macOS, even when onboarded to Defender for Endpoint.

ASR RULE MODES#

0  Off / Disabled        rule explicitly off (can conflict across policies)
1  Block / Enabled       rule blocks
2  Audit / AuditMode     logs what would be blocked, takes no action
5  Not configured        same effect as Off, without policy conflicts
6  Warn                  blocks; user can Unblock for 24 hours
# Warn needs Windows 10 1809+; older versions treat Warn as Block.
# Warn not supported for: LSASS credential stealing, Office code injection.
# Platform 4.18.26060+: Unblock in Warn mode needs administrator approval.
# Microsoft: Block for the standard protection rules, Audit first for the
# rest. Use per-rule exclusions for durable exceptions, not Unblock.

ASR RULES AND GUIDS: STANDARD PROTECTION#

56a863a9-875e-4185-98a7-b882c64b5ce5  vulnerable signed drivers (saving)
9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2  credential stealing from LSASS
e6db77e5-3df2-4cf1-b95a-636979351e5b  persistence via WMI event subscription

ASR RULES AND GUIDS: OTHER RULES#

7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c  Adobe Reader child processes
d4f940ab-401b-4efc-aadc-ad5f3c50688a  all Office apps child processes
be9ba2d9-53ea-4cdc-84e5-9b1eeee46550  executable content from email/webmail
01443614-cd74-433a-b99e-2ecdc07bfc25  executables failing prevalence/age/
                                      trusted-list criteria
5beb7efe-fd9a-4556-801d-275e5ffc04cc  potentially obfuscated scripts
d3e037e1-3eb8-44c8-a917-57927947596d  JS/VBScript launching downloaded
                                      executable content
3b576869-a4ec-4529-8536-b80a7769e899  Office apps creating executable content
75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84  Office apps injecting into processes
26190899-1602-49e8-8b27-eb1d0a1ce869  Office communication app (Outlook)
                                      child processes
d1e49aac-8f56-4280-b9ba-993a6d77406c  process creation from PSExec and WMI
33ddedf1-c6e0-47cb-833e-de6133960387  rebooting the machine in Safe Mode
b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4  untrusted/unsigned processes from USB
c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb  copied or impersonated system tools
a8f5898e-1dc8-49a9-9878-85004b8a61e6  webshell creation for servers
92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b  Win32 API calls from Office macros
c1db55ab-c21a-4637-bb3f-a12568109d35  advanced protection against ransomware
# Each rule name above starts with "Block" except the last ("Use ...").
# The vulnerable-driver rule stops drivers being SAVED, not existing ones
# loading: add the Microsoft vulnerable driver block list / App Control.

CONFIGURE ASR WITH POWERSHELL (elevated; local device)#

# Set-MpPreference REPLACES the rule list; Add-/Remove- change one entry.
Add-MpPreference -AttackSurfaceReductionRules_Ids <GUID> `
  -AttackSurfaceReductionRules_Actions AuditMode
Add-MpPreference -AttackSurfaceReductionRules_Ids <GUID> `
  -AttackSurfaceReductionRules_Actions Enabled          # Block
Remove-MpPreference -AttackSurfaceReductionRules_Ids <GUID>
# Valid actions: 0/Disabled 1/Enabled 2/AuditMode 5/NotConfigured 6/Warn

# List rules and modes on this device (from Microsoft Learn)
$p = Get-MpPreference
0..([math]::Min($p.AttackSurfaceReductionRules_Ids.Count,
  $p.AttackSurfaceReductionRules_Actions.Count)-1) | % {
  [pscustomobject]@{Id=$p.AttackSurfaceReductionRules_Ids[$_];
  Action=$p.AttackSurfaceReductionRules_Actions[$_]}} | Format-Table -AutoSize

# Exclusions that apply to ALL ASR rules (path or path + file name)
(Get-MpPreference).AttackSurfaceReductionOnlyExclusions
Add-MpPreference -AttackSurfaceReductionOnlyExclusions "C:\Apps\LOB\app.exe"
# Intune, Configuration Manager or other management tools overwrite
# conflicting local PowerShell settings at startup.

CONFIGURE ASR WITH GROUP POLICY, INTUNE OR CSP#

# GPO: Computer Configuration > Administrative Templates > Windows
#   Components > Microsoft Defender Antivirus > Microsoft Defender Exploit
#   Guard > Attack Surface Reduction
#   "Configure Attack Surface Reduction rules": value name = rule GUID,
#   value = mode (0, 1, 2, 5, 6). No quotes or leading/trailing spaces.
#   "Exclude files and paths from Attack surface reduction rules"
#   "Apply a list of exclusions to specific attack surface reduction
#   (ASR) rules"  (per-rule exclusions)
# Before Windows 10 2004 the path may read "Windows Defender Antivirus".
# Policy CSP (custom OMA-URI), value = GUID=mode pairs separated by "|":
./Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionRules
./Device/Vendor/MSFT/Policy/Config/Defender/AttackSurfaceReductionOnlyExclusions

ASR EVENTS (Windows Defender > Operational)#

1121  ASR rule fired in Block mode
1122  ASR rule fired in Audit mode
1129  user overrode a block in Warn mode
5007  Defender settings changed (watch for rules switched off or new
      exclusions; a tamper signal as well as an admin change)
# Log: Applications and Services Logs > Microsoft > Windows >
#      Windows Defender > Operational
Get-WinEvent -FilterHashtable @{
  LogName='Microsoft-Windows-Windows Defender/Operational'
  Id=1121,1122,1129,5007} -MaxEvents 200 |
  Select-Object TimeCreated, Id, Message | Format-List

CONTROLLED FOLDER ACCESS AND NETWORK PROTECTION#

Set-MpPreference -EnableControlledFolderAccess AuditMode
# CFA modes: 0 Disabled, 1 Enabled, 2 AuditMode,
#            3 BlockDiskModificationOnly, 4 AuditDiskModificationOnly
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Finance"
Add-MpPreference -ControlledFolderAccessAllowedApplications `
  "C:\Apps\LOB\app.exe"
Set-MpPreference -EnableNetworkProtection AuditMode   # or Enabled
# Windows Server 2019+: add -AllowNetworkProtectionOnWinServer $true
# (Server 2016 / 2012 R2 with the modern unified solution: also
#  -AllowNetworkProtectionDownLevel $true)
Get-MpPreference | Select-Object EnableControlledFolderAccess,
  EnableNetworkProtection
# Events (Windows Defender > Operational):
#   CFA  1123 blocked, 1124 audited,
#        1127 sector write blocked, 1128 sector write audited
#   NP   1125 audit mode, 1126 block mode

HUNTING IN DEFENDER (advanced hunting, KQL)#

// ASR detections by rule and mode, last 7 days
DeviceEvents
| where Timestamp > ago(7d) and ActionType startswith "Asr"
| summarize Devices=dcount(DeviceName), Hits=count() by ActionType
| order by Hits desc

// What would break if you switched Audit to Block
DeviceEvents
| where ActionType startswith "Asr" and ActionType endswith "Audited"
| summarize Hits=count() by ActionType, FileName, FolderPath,
    InitiatingProcessFileName
| order by Hits desc

# Action type pairs are <Name>Audited / <Name>Blocked, for example:
#   AsrLsassCredentialTheftAudited / ...Blocked
#   AsrOfficeChildProcessAudited / ...Blocked
#   AsrPersistenceThroughWmiAudited / ...Blocked
#   AsrPsexecWmiChildProcessAudited / ...Blocked
#   AsrRansomwareAudited / ...Blocked
# Warn bypasses: AsrSafeModeRebootWarnBypassed,
#   AsrAbusedSystemToolWarnBypassed
# The webshell rule has no advanced hunting action type.

APP CONTROL FOR BUSINESS (formerly WDAC)#

# Logs: Microsoft > Windows > CodeIntegrity > Operational (exe/dll/driver)
#       Microsoft > Windows > AppLocker > MSI and Script (scripts, MSI,
#       COM, packaged apps)
3076  file would have been blocked (audit mode policy)  - main audit event
3077  file blocked (enforced policy)                    - main block event
3089  signature details for a 3076/3077 file (match on Correlation
      ActivityID; unsigned file = TotalSignatureCount 0)
3033  blocked: revoked signature, or expired Lifetime Signing EKU
3034  audit-mode equivalent of 3033
3004  kernel driver with an invalid signature (with or without a policy)
3099  policy loaded
8028  script/MSI would fail the policy (audit)
8029  script/MSI blocked (enforced); PowerShell then runs the script in
      Constrained Language Mode rather than refusing it
8036  COM object blocked
8039  packaged app allowed because the policy is in audit mode
8040  packaged app blocked
# App Control logs no event for allowed files (except optional managed
# installer / ISG allow events).

Get-WinEvent -FilterHashtable @{
  LogName='Microsoft-Windows-CodeIntegrity/Operational'
  Id=3076,3077} -MaxEvents 100 | Format-List TimeCreated, Id, Message

# Windows 11 22H2+ and Windows Server 2025: CiTool
CiTool --list-policies                          # alias -lp
CiTool --update-policy "C:\Policies\{GUID}.cip"
CiTool --refresh                                # alias -r
CiTool --remove-policy "{GUID}"

// Hunting: App Control action types (ActionType starts with "AppControl")
DeviceEvents
| where Timestamp > ago(7d) and ActionType startswith "AppControl"
| summarize Machines=dcount(DeviceName) by ActionType
| order by Machines desc
#   AppControlCodeIntegrityPolicyAudited (3076)
#   AppControlCodeIntegrityPolicyBlocked (3077)
#   AppControlCIScriptAudited (8028) / AppControlCIScriptBlocked (8029)

APPLOCKER#

# Logs: Microsoft > Windows > AppLocker > EXE and DLL / MSI and Script /
#       Packaged app-Deployment / Packaged app-Execution
8001  policy applied             8000  policy conversion failed
8002  exe/dll allowed            8003  exe/dll would be blocked (audit)
8004  exe/dll blocked            8005  script/MSI allowed
8006  script/MSI would be blocked (audit)
8007  script/MSI blocked
8021  packaged app would be blocked (audit)
8022  packaged app blocked
8008  AppLocker not available on this Windows edition
Get-AppLockerPolicy -Effective -Xml > applocker-effective.xml
Get-AppLockerPolicy -Local                      # local policy only
Get-WinEvent -FilterHashtable @{
  LogName='Microsoft-Windows-AppLocker/EXE and DLL'; Id=8003,8004} `
  -MaxEvents 100 | Format-List TimeCreated, Id, Message
# The EXE and DLL log is very verbose: when forwarding to a SIEM,
# consider collecting only Error (block) events from it.

ROLL-OUT ORDER#

1. Inventory: which line-of-business apps run Office macros, scripts,
   PsExec/WMI, or start from USB or user-writable folders.
2. Put ASR rules (and App Control or AppLocker) in Audit; CFA and
   network protection in AuditMode.
3. Collect 1122 / 3076 / 8003 / 8006 events and the Audited hunting
   results for a few weeks; add narrow per-rule exclusions.
4. Enforce the standard protection rules in Block first, then the rest
   ring by ring (pilot group, then wider).
5. Alert on 5007 (settings changed), new exclusions and rules set back
   to 0 or 5.

WHAT TO HUNT FOR (MITRE ATT&CK, as hunting leads)#

T1003.001  LSASS memory access        AsrLsassCredentialTheft*
T1546.003  WMI event subscription     AsrPersistenceThroughWmi*
T1047      WMI process creation       AsrPsexecWmiChildProcess*
T1569.002  service execution (PsExec) AsrPsexecWmiChildProcess*
T1059.005  Visual Basic / VBA macros  AsrOfficeMacroWin32ApiCalls*
T1204.002  user opens malicious file  AsrOfficeChildProcess*

GUIDs, modes, cmdlets, Group Policy paths, CSP paths, event IDs and
advanced hunting action types were checked against Microsoft Learn
(Defender for Endpoint ASR rules reference, configure ASR rules and
exclusions, ASR events in Windows Event Viewer, controlled folder
access, network protection; App Control for Business event IDs, advanced
hunting and CiTool references; AppLocker Event Viewer and
Get-AppLockerPolicy), not run on a live device. Technique IDs per
MITRE ATT&CK Enterprise.

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.