Application allowlisting with Windows Defender ASR rules

Overview

Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macros, script execution, and credential theft behaviors. Allowlisting must be deliberate so security posture does not erode.

Planning

1. Inventory LOB apps that spawn child processes from Office, script hosts, or WMI.
2. Start ASR policies in Audit mode for 2–4 weeks on pilot groups; export blocked events.
3. Build a CSV of required overrides with justification, owner, and expiry.

Implementation pattern

1. Create an Intune Attack surface reduction profile (or use tenant-wide policy with exclusions).
2. Map audit hits to:
   • specific ASR per-rule exclusions (preferred),
   • trusted folders where unavoidable (discouraged),
   • or redesign of the LOB installer/updater.

High-value rules to discuss with clients

• Block credential stealing from the Windows local security authority subsystem (lsass.exe).
• Block executable content from email client and webmail (often noisy—tune carefully).
• Block Office applications from creating child processes (breaks poorly written macros—migrate to supported automation).

Verification

1. Confirm policy assignment scopes exclude servers if server policy is separate.
2. Review defender event logs and Advanced Hunting for ASR 1121/1122 (audit/block) events after go-live.
3. Establish a monthly review of exclusions in security.microsoft.com.

Governance

Maintain a single source of truth for ASR exclusions; duplicate GPO + Intune rules cause shadow overrides.