Overview of impact-reduction rule deployment
The face of the attack is all locations where the organization is vulnerable to cyber-threats and attacks. Reducing the face of the attack means protecting the equipment and networks of the organization, so that the attackers attack less. It might be helpful to configure Microsoft Defender for Endpoint offensive face reduction rules.
The face-to-face reduction rules target certain software behaviours, such as:
- Executable files and scripts to start trying to download or run files
- Run vaguely processed scripts or other suspicious scripts
- In normal day-to-day work, apply behavior that normally does not happen
By reducing the number of different attacks, it can help to prevent them first.
This deployment assembly provides information on the following ground reduction rules:
- Face-to-face reduction rule requirements
- Plan for impact reduction rule deployment
- Test the surface reduction rule.
- Configure and activate attack face reduction rules
- Best practice of the assault face reduction rule
- We're looking for a code-deficient search.
- Impact Face Reduction Event Viewer
Sphere reduction rule deployment steps
As with any new large-scale implementation that may affect the operation of the line of operations, planning and implementation must be orderly. The impact-reduction rules need to be carefully planned and deployed to ensure that they are best suited to unique client workflows. Working in your environment requires careful planning, testing, implementation and enforcement of impact reduction rules.
Critical predeployment care
It is recommended that the following three be enabledStandard protection rulesI don't know. About two typesFace reduction rule.For important details, please refer to the impact reduction rules by type.
- Stop stealing evidence from Windows local security subsystems (lsass.exe)
- Prevent the misuse of vulnerable signed drivers
- Stop Persistence by subscription to events (WMI)
As a rule, standard protection rules can be activated, with minimal impact on end-users and no visible impact. For a simple approach to the use of standard protection rules, seeSimplified standard protection optionsI don't know.
Remarks
For customers who use non-MSC HIPS and convert it to Microsoft Defender for Endpoint attack reduction rules, Microsoft recommends that the HIPS solution be deployed with the impact reduction rules before switching from audit mode to stop mode. Please remember that non-MSV providers must be contacted to obtain exclusion recommendations.
Before testing or activation of the surface reduction rule
During initial preparation, it is essential to understand the functionality of the system in place. Knowledge of these functions helps to determine which offensive mitigation rules are most important for the protection of the organization. In addition, a number of preconditions must be met in preparation for a reduction in the level of deployment.
Important
This guide provides images and examples that can help you decide how to configure the impact face reduction rules; These images and examples may not reflect the best configuration options for the environment.
Before starting, please check.Overview of reduction of attackandDecrypt Spectrum Reduction – Part 1, get basic information. For information on coverage and potential areas of impact, please familiarize yourself with the current Spectacular Mitigation Rulebook:Ground reduction rule referenceI don't know. When familiar with the surface reduction rule set, write down each rule GUID map; seeGUID Matrix Attack Face Reduction RuleI don't know.
An attack face reduction rule is only one function of the impact face reduction function within Microsoft Defender for Endpoint. This document provides more detailed information on the effective deployment of attack face mitigation rules to deter high-level threats, such as man-made extortion software and other threats.
List of attack face reduction rules by category
The following table shows the impact reduction rules by category:
| Multiple threat | Horizontal Movement & Evidencefault | Productivity application rules | Email Rules | Script Rules | Miscellaneous rules |
|---|---|---|---|---|---|
| Stop running executable files unless they meet 1,000 computers () or age or trusted list conditions | Prevent process creation from PSExec and WMI commands | Stop Office application to create executable | Disable from email client and Webmail | Block Fuzzy Processing JS/VBS/PS/ Macro Code | Prevents the misuse of vulnerable signed drives that are exploited [1] |
| Stop untrusted and unsigned processes running from USB | Stop stealing documents from Windows' local security subsystems (lsass.exe)2] | Stop Office Application Create Subprocesses | Only prevent the Office communication application creation sub-process | Executable content that prevents JS/VBS from starting downloads | |
| Advanced protection against extortion software | Stop Persistence by WMI Organisation | Stop Office application to inject code into other processes | Stop Office Communication Application Creation Subprocess | ||
| Stop the Adobe Reader creation subprocess |
(1 member)Prevent the misuse of attack-prone signed driverNow.“Endpoint security>We're losing face.It's provided below.
(2) Some surface reduction rules can cause considerable disruption, but do not prevent functionality. For example, if you want to update Chrome, Chrome will accessI don't know.; passwords stored on devicesI don't know.Medium. But...I don't know.Visit local equipment. If the rules are enabled to stop rightAccess to lsassThere are many incidents. These events are a good one, as the software update process should not have access to lass.exe. Use this rule to prevent Chrome updatesI don't know., but does not prevent Chrome from updating. Yeah.I don't know.The same is true of other applications that have made unnecessary calls.Block access to lsass rulesIt'll stop.I don't know., but does not prevent the application from running.
Reduction of infrastructure requirements in the face of attack
Although there are a number of methods that can be used to achieve the impact reduction rule, the Guide is based on the principle that:
- Microsoft Entra ID
- Microsoft Intune
- Windows 10 and Windows 11 devices
- Microsoft Defense for Endpoint E5 or Windows E5 license
In order to make full use of impact reduction rules and reports, we recommend the use of Microsoft Defender XDR E5 or Windows E5 licences and A5. For more information, seeMicrosoft Defender for EndpointI don't know.
Remarks
There are a number of ways in which the attack face reduction rules can be configured. The attack face reduction rules can be configured in the following ways: Microsoft Intune, PowerShell, Group Strategy, Microsoft Construction Manager (ConfigMgr) Intune OMA-URI. If the infrastructure configuration used is different from the infrastructureRequestThe configuration listed here gives us a detailed idea of how to deploy the attack using other configurations.Face reduction rules: use of offensive face reduction rulesI don't know.
The Declining Face rule depends on it.
Microsoft Defender ' s anti-virus must be activated and configured as the main anti-virus solution and must be in the following mode:
- Main anti-virus/anti-malarial software solutions
- Status: Activity mode
Microsoft Defender should not be in any of the following patterns:
- Passive
- Passive mode with terminal detection and response (EDR in block mode)
- Limited periodic scanning (LPS)
- Close
Detailed informationSee the protection from clouds and Microsoft Defender against the virus.I don't know.
The cloud protection (MAPS) must be activated in order to enable impact reduction.
Microsoft Defender can work seamlessly with Microsoft Cloud Services. These cloud protection services (also known as the Microsoft Advanced Protection Service (MAPS)) enhance standard real-time protection and can be described as providing the best anti-virus defence. Cloud protection is essential to prevent malign software violations and is a key component of the assault face reduction rule.Enable cloud protection in Microsoft Defender antivirusI don't know.
Microsoft Defender antivirus components must be the current version of the impact face reduction rule.
The following version of Microsoft Defender ' s anti-virus component should not exceed two versions before the current available version:
- Updated Microsoft Defender anti-virus platform– The Microsoft Defender anti-virus platform is updated monthly.
- Microsoft Defender antivirus engine version– Microsoft Defender anti-virus engine is updated monthly.
- Microsoft Defender Anti-Virus Security Intelligence– Microsoft continuously updates Microsoft Defender Security Intelligence (also known as definitions and signatures) to address the latest threats and optimize detection logic.
Keeping Microsoft Defender ' s anti-virus version up to date would help to reduce the number of attack-face-reduced errors and improve Microsoft Defender ' s anti-virus detection function. More information on the current version and how to update the different Microsoft Defender antivirus components is available.Microsoft Defender anti-virus platform supportI don't know.
Warning
Some rules will not work if unsigned, internally developed applications and scripts are used more frequently. If code signatures are not enforced, it will be more difficult to deploy a face reduction rule.