How to Protect Windows Devices From Ransomware Using Attack Surface Reduction Rules
- Hanna Korotka
- 48 minutes ago
- 3 min read
Ransomware continues to be the top threat affecting small and midsize businesses. Attackers increasingly rely on legitimate tools—Office macros, scripts, email attachments, and remote execution—to slip past traditional antivirus.
Microsoft’s Attack Surface Reduction (ASR) Rules offer a powerful, proactive layer of defense by blocking these behaviors before they execute. Microsoft confirms that ASR rules target behaviors used in malware, ransomware, and advanced attacks, helping organizations prevent compromises early in the kill chain. ASR rules are part of Microsoft Defender for Endpoint and protect Windows 10/11 devices from exploit techniques like child‑process creation, script abuse, malicious email attachments, and credential theft.
For SMBs with limited IT staff, ASR delivers big‑company protection with small‑company simplicity—especially when deployed through Microsoft Intune.
What Are Attack Surface Reduction Rules?
Microsoft defines ASR rules as a set of controls that block risky or malicious behaviors commonly used during ransomware attacks—such as Office apps launching PowerShell, scripts calling downloaded executables, or malware attempting to steal credentials. These rules can be run in Audit, Warn, or Block mode depending on your setup.
Each rule targets a specific attacker technique. Some examples include:
Block Office communication application from creating child processes
Block executable content from email client and webmail
Block Adobe Reader from creating child processes
Block use of copied or impersonated system tools
Block Win32 API calls from Office macros
Enabling the right combination significantly reduces the ways ransomware can start, spread, and escalate.
How to Deploy ASR Rules in Microsoft Intune
1. Confirm Prerequisites
Before configuring ASR rules, ensure:
Microsoft Defender Antivirus is running in active mode
Devices run Windows 10 1709+ or Windows 11
Devices are onboarded to Microsoft Defender for Endpoint for reporting
Identify Which ASR Rules You Want to Enable
Microsoft categorizes rules into standard protection rules (safe to enable broadly) and other rules that may require testing. Standard rules include protections like:
Block abuse of exploited vulnerable signed drivers
Block credential stealing from the Windows local security authority subsystem (lsass.exe)
Block persistence through WMI event subscription
For ransomware prevention specifically, focus on:
Block Office applications from creating executable content
Block Office applications from injecting code into other processes
Block JavaScript or VBScript from launching downloaded executable content
Block process creations originating from PSExec and WMI commands
Block credential stealing from the Windows local security authority subsystem (lsass.exe)
3. Create a Configuration Profile in Intune
Navigate to Microsoft Intune Admin Center → Endpoint security → Attack surface reduction
Select Create Policy
Choose Platform: Windows
Choose Profile Type: Attack Surface Reduction Rules
You will see a list of rules with toggle options for:
Not configured
Off (Default)
Audit
Warn
Block
Configure rules, assign to devices (test with a small pilot group first) and Save the policy.
Best practice for SMBs: Start in Audit, monitor impact, then move to Block.
4. Monitor Impact in Microsoft Defender
The attack surface reduction rules reporting page is found in Microsoft Defender portal > Reports > Endpoints > Attack surface reduction rules. (ASR reporting is documented in Microsoft’s guidance via this link)
How ASR Rules Stop Ransomware in Real Life
Here’s how ASR rules help prevent common ransomware pathways:
Phishing Emails
Blocking executable content from email prevents payloads from detonating even if a user opens them.
Malicious Office Files
Preventing Office apps from launching child processes stops ransomware droppers that rely on PowerShell or CMD to download additional payloads.
Script‑Based Attacks
ASR rules block suspicious JavaScript/VBScript actions frequently used by ransomware loaders.
Credential Theft
Blocking LSASS credential dumping stops attackers from spreading laterally.
Microsoft highlights that ASR is one of the strongest layers in “behavioral blocking and containment,” stopping dangerous actions before traditional detection even begins.
Conclusion
Implementing Attack Surface Reduction Rules is one of the fastest ways to harden your Windows environment against ransomware attacks. By blocking malicious behaviors at the source, SMBs significantly reduce their exposure—without buying new tools or adding complexity.
How We Can Help
As an MSSP specializing in Microsoft Cloud security, we help SMBs plan, deploy, and fine‑tune ASR rules, implement safe exceptions, and continuously monitor device behavior to ensure long‑term protection. Whether you need a full rollout, a quick audit, or ongoing managed security, our team can take the workload off your plate so you stay protected without the complexity.