Defender ASR rules

Set-MpPreference -AttackSurfaceReductionRules_Ids <id> -AttackSurfaceReductionRules_Actions Enabled

Activates Defender's attack surface reduction (ASR) rules, blocking typical attack behaviors on the host.

Run it when you want Defender's behavioral blocking layer: ASR rules block attack patterns — execution of obfuscated scripts, ransomware (folder protection), WMI abuse, Office creating child processes, payloads downloaded by Office — by rule GUID. The command activates the rule (or puts it in audit mode for testing). In hardening, ASR is Defender's behavioral piece: an attack that depends on the blocked pattern (the macro that launches PowerShell, the obfuscated script) fails on the attempt. Rules are enabled in phases: audit first, then block.

Don't enable them without the audit phase: ASR rules block legitimate behavior (admin tools, custom scripts, Office workflows) — audit mode logs potential blocks (events 5007/1121) and they are reviewed before enforcing the block. Rules don't cover everything: an attacker with signed binaries or techniques outside the patterns evades them — they are a layer, not a silver bullet. And watch out for management: rules are managed by GUID and state per host; in the domain, policy (Intune/GPO) is the deployment mechanism, and the command is for local configuration or verification.