Microsoft Defender Attack Surface Reduction (ASR) Rules Configurator
ASR Configurator is an open-source visual tool for generating PowerShell, Microsoft Intune, and Group Policy configurations for all 19 Microsoft Defender Attack Surface Reduction rules.
Action Values & Monitoring
- 0 = Disabled: Rule inactive.
- 1 = Block: Prevents action. Generates Event ID 1121 in Microsoft-Windows-Windows Defender/Operational.
- 2 = Audit: Monitors action without blocking. Generates Event ID 1122 for testing impact.
19 Official ASR Rules
- Block abuse of exploited vulnerable signed drivers:
56A863A9-875E-4185-98A7-B882C64B5CE5 (System)
- Block Adobe Reader from creating child processes:
7674BA52-37EB-4A4F-A9A1-F0F9A1619A2C (App)
- Block all Office applications from creating child processes:
D4F940AB-401B-4EFC-AADC-AD5F3C50688A (Office)
- Block credential stealing from LSASS:
9E6C4E1F-7D60-472F-BA1A-A39EF669E4B2 (Credential)
- Block executable content from email client and webmail:
BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 (Email)
- Block executable files unless they meet prevalence/age/trusted list:
01443614-CD74-433A-B99E-2ECDC07BFC25 (App)
- Block execution of potentially obfuscated scripts:
5BEB7EFE-FD9A-4556-801D-275E5FFC04CC (Script)
- Block JavaScript/VBScript from launching downloaded executables:
D3E037E1-3EB8-44C8-A917-57927947596D (Web)
- Block Office applications from creating executable content:
3B576869-A4EC-4529-8536-B80A7769E899 (Office)
- Block Office apps from injecting code into other processes:
75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84 (Office)
- Block Office communication apps from creating child processes:
26190899-1602-49E8-8B27-EB1D0A1CE869 (Email)
- Block persistence through WMI event subscription:
E6DB77E5-3DF2-4CF1-B95A-636979351E5B (System)
- Block process creations from PSExec and WMI commands:
D1E49AAC-8F56-4280-B9BA-993A6D77406C (Remote)
- Block untrusted and unsigned processes that run from USB:
B2B3F03D-6A65-4F7B-A9C7-1C7EF74A9BA4 (USB)
- Block Win32 API calls from Office macros:
92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B (Office)
- Use advanced protection against ransomware:
C1DB55AB-C21A-4637-BB3F-A12568109D35 (Ransomware)
- Block rebooting machine in Safe Mode:
33DDEDF1-C6E0-47CB-833E-DE6133960387 (System)
- Block Webshell creation for Servers:
A8F5898E-1DC8-49A9-9878-85004B8A61E6 (Server)
- Block use of copied or impersonated system tools:
C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB (System)
Enable JavaScript to use the interactive generator, test presets, and export PowerShell scripts or Intune profiles.