Attack Surface Reduction (ASR) & Intune Hardening Codex

PROACTIVE DEFENSE MDE TELEMETRY & INTUNE Operating Systems: Windows 10/11 & macOS

Attack Surface Reduction (ASR) rules in Microsoft Defender for Endpoint prevent common adversary techniques before code can execute. Configured via Microsoft Intune Endpoint Security, ASR forms the first line of defense against phishing attachments, LOLBins, and LSASS dumping.

🛡️ Master ASR Rule Reference Matrix

Rule Name	Rule GUID	Recommended Posture	Primary Threat Mitigated
Block credential stealing from LSASS	`9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2`	Block	Mimikatz, procdump, unbacked memory read
Block executable content from email client	`be9ba2d9-53ea-44a7-a4c1-794c7466e5f0`	Block	Phishing executables, ISOs, and script droppers
Block Office apps from creating child processes	`d4f940ab-401b-4efc-aadc-ad5f3c50688a`	Block	Macro execution spawning cmd.exe or powershell
Block Office apps from injecting into other processes	`75668c1f-43b5-4276-8c1e-b1d5e46cd852`	Block	Process hollowing initiated from Word or Excel
Block abuse of exploited vulnerable signed drivers	`56a863a9-8769-4837-a73a-56321fdeee43`	Block	BYOVD (Bring Your Own Vulnerable Driver) attacks
Block untrusted and unsigned processes from USB	`b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4`	Block	Rogue USB storage worm propagation
Block Win32 API calls from Office macros	`92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b`	Block	Shellcode injection from Visual Basic scripts
Block persistence through WMI event subscription	`e6db77e5-3e12-4247-8117-00e0ff4e6e5e`	Block	WMI event consumers and stealth persistence
Block process creation from PSExec and WMI	`d1e49aac-8f56-4280-b9ba-993a6d77406c`	Audit first	Lateral movement via remote execution

⚡ KQL Threat Hunting: ASR Telemetry

All ASR rule evaluations (Audit and Block) generate events in the DeviceEvents table in Microsoft Defender XDR:

Hunting All ASR Blocks & Audits (Last 7 Days)

DeviceEvents
| where TimeGenerated > ago(7d)
| where ActionType startswith "Asr"
| parse ActionType with "Asr" RuleAction "Rule"
| project TimeGenerated, DeviceName, ActionType, RuleAction,
          FileName, FolderPath, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| summarize EventCount = count() by ActionType, RuleAction, InitiatingProcessFileName, FileName
| order by EventCount desc

Unmasking LSASS Credential Theft Attempts via ASR

DeviceEvents
| where TimeGenerated > ago(14d)
| where ActionType in ("AsrLsassCredentialTheftBlocked", "AsrLsassCredentialTheftAudited")
| project TimeGenerated, DeviceName, ActionType, InitiatingProcessFileName,
          InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated desc

☁️ Intune Compliance Troubleshooting Matrix

When a cloud-managed endpoint reports Non-Compliant in the Intune admin center (intune.microsoft.com), follow this rapid triage matrix:

Failure Symptom	Root Cause	Remediation Procedure
BitLocker Not Encrypted	TPM 2.0 unready or key failed escrow	Run PowerShell: `Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[1].KeyProtectorId`
Secure Boot Disabled	UEFI settings altered or legacy CSM enabled	Reboot to UEFI firmware and enable Secure Boot with standard keys
Defender Tamper Protection Off	Local policy or registry override attempted	Push Intune Endpoint Security Antivirus profile with Tamper Protection forced
Firewall Inactive	Third-party software or disabled profiles	Run `Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True`
Code Integrity (HVCI) Off	Incompatible driver blocking Virtualization-Based Security	Run Driver Verifier / Sigverif to isolate obsolete hardware drivers