Attack Surface Reduction & Security Baselines

Attack Surface Reduction (ASR)

Simple explanation

If antivirus is a guard who catches intruders inside the building, ASR is boarding up the windows they’d use to break in.

ASR rules block the TECHNIQUES attackers use — like Office macros that download malware, scripts that run from email attachments, or processes that inject code into other programs. Instead of detecting malware after it runs, ASR prevents the attack method from working in the first place.

Key ASR rules

Rule	What It Blocks	Why It Matters
Block Office apps from creating executable content	Macros that drop .exe files	Prevents macro-based malware delivery
Block Office apps from injecting code into other processes	Process injection from Office	Stops Office from being a launchpad for attacks
Block executable content from email client and webmail	Executables opened from email	Prevents phishing attachments from executing
Block JavaScript or VBScript from launching downloaded content	Script-based downloaders	Stops “download and execute” attack chains
Block credential stealing from LSASS	Memory scraping of credentials	Prevents pass-the-hash attacks
Block untrusted/unsigned processes from USB	USB-based attacks	Stops malware from USB drives
Block process creations from PSExec and WMI	Lateral movement tools	Prevents attackers from spreading across the network

ASR rule modes

Mode	Behaviour	When to Use
Not configured	Rule is off	Default state
Block	Rule actively blocks the behaviour	Production — after testing
Audit	Rule logs the behaviour but doesn’t block	Testing — see impact before blocking
Warn	User sees a warning but can override	Transition — educate users before enforcing

Exam tip: audit mode first

The exam expects you to know the recommended deployment approach:

Audit mode first — deploy rules in audit to see which legitimate activities would be blocked
Review audit logs (Defender portal → Reports → ASR)
Create exclusions for legitimate business processes that trigger rules
Switch to Block mode for production enforcement

If a question asks “how should Chen Wei deploy ASR rules to 10,000 devices safely?” — start with Audit, then move to Block after testing.

Security baselines

What are they?

Security baselines are Microsoft-recommended security configuration templates. Instead of configuring hundreds of individual security settings, you apply a baseline that represents Microsoft’s best-practice security posture.

Available baselines in Intune

Baseline	What It Configures
Microsoft Defender for Endpoint	Defender AV settings, ASR rules, network protection, exploit protection
Windows 365 Security Baseline	Cloud PC-specific security settings
Microsoft Edge Baseline	Browser security: SmartScreen, password manager, extension control
Windows MDM Security Baseline	OS-level settings: BitLocker, firewall, account lockout, audit policies

Security baselines vs custom policies

Feature	Security Baselines	Custom Policies
Configuration source	Microsoft's recommended settings	Admin defines every setting
Effort to create	Low — select baseline, override where needed	High — configure each setting individually
Updates	Microsoft releases new baseline versions periodically	Admin must update manually
Flexibility	Can override individual settings	Complete control over every setting
Best for	Starting point — apply baseline, then customise	Organisations with specific security requirements
Conflict risk	Can conflict with existing config profiles	You control everything — fewer surprises

Deep dive: baseline versioning and conflicts

Microsoft periodically releases new versions of security baselines. When a new version arrives:

Existing baseline assignments don’t automatically update — they stay on the version you deployed
You must manually create a new profile with the new baseline version and assign it
Compare old vs new version to understand what changed before deploying

Conflict warning: If you have a security baseline AND a custom device configuration profile that configure the same setting with different values, there will be a conflict. The conflict is flagged in device status. Resolution: either remove the setting from the custom profile or override it in the baseline.

🎬 Video walkthrough

🎬 Video coming soon

Attack Surface Reduction & Security Baselines — MD-102 Module 24

~11 min

Flashcards

Question

What do Attack Surface Reduction (ASR) rules do?

Click or press Enter to reveal answer

Answer

Block specific attack TECHNIQUES rather than specific malware. They prevent behaviours like Office macros creating executables, scripts downloading content, credential theft from LSASS, and USB-based attacks. Configured in Intune endpoint security → Attack surface reduction.

Click to flip back

Question

What's the recommended way to deploy ASR rules?

Click or press Enter to reveal answer

Answer

Start in Audit mode (logs but doesn't block), review logs for false positives, create exclusions for legitimate processes, then switch to Block mode. Never deploy straight to Block on a large fleet.

Click to flip back

Question

What is a security baseline in Intune?

Click or press Enter to reveal answer

Answer

A Microsoft-recommended template of security settings that represents best-practice configuration. Available for Defender for Endpoint, Windows MDM, Edge, and Windows 365. Apply as a starting point, then override individual settings where your org needs differ.

Click to flip back

Knowledge Check

Chen Wei wants to block Office macros from creating executable files on all 10,000 Meridian Bank devices. But he's worried about blocking legitimate macro-based workflows in the finance department. What's the recommended approach?

Knowledge Check

Chen Wei applies a Microsoft Defender for Endpoint security baseline AND a custom device configuration profile to the same device group. Both configure the 'Cloud-delivered protection level' setting but with different values. What happens?

Next up: Defender for Endpoint: Integrate & Onboard — connecting Intune with Microsoft Defender for Endpoint for advanced threat protection.