Attack surface reduction rules are Microsoft Defender Antivirus settings that block behaviours malware often uses. Microsoft recommends block mode for three standard protection rules and audit mode first for the rest. On a developer PC, audit first matters, because legitimate dev tools can look like malware.
What ASR rules target
Microsoft says ASR rules target risky software behaviour on Windows devices. Examples include launching executables and scripts that try to download or run files, running obfuscated or untrusted scripts, creating child processes from vulnerable applications such as Office apps, and injecting code into other processes.
Legitimate software can do these things too, which is the reason for a testing phase.
Standard protection rules
Microsoft puts three rules in this group and recommends block mode without extensive testing:
- Block abuse of exploited vulnerable signed drivers.
- Block credential stealing from the Windows local security authority subsystem.
- Block persistence through WMI event subscription.
There are caveats. If you manage devices with Microsoft Configuration Manager, do not enable the WMI rule through other methods without extensive audit testing, because that client relies on WMI. And if you have enabled LSA protection, the credential theft rule is redundant.
The other rules
The rest, including blocking obfuscated scripts and blocking process creations from PSExec and WMI commands, need testing in audit mode before you move them to block or warn.
Developers hit these because build scripts, installers and automation commonly spawn processes and run scripts.
Modes
- Block: the rule takes action.
- Audit: behaves as if in block mode but takes no action. Detections appear in Event Viewer and, with advanced hunting, in a Defender query.
- Warn: blocks, but the user can unblock for 24 hours. Microsoft notes that administrator approval is now required for the unblock option, from platform version 4.18.26060.
- Off and Not configured.
Requirements
Defender Antivirus must be the primary antivirus in active mode, real-time protection must be on, and cloud-delivered protection is described as critical to ASR rule function. ASR rules are a Windows feature and are not available on Linux or macOS.
You can configure them locally with PowerShell. Pro and Enterprise editions can also use Group Policy.
A rollout for a team
- Turn on the three standard rules in block mode.
- Put the other rules in audit mode on a few developer machines.
- Review audit events for a couple of weeks of real work.
- Add per-rule exclusions only for tools you have a reason to trust.
- Move rules to block or warn one at a time.
Microsoft warns that excluding files or folders can severely reduce ASR protection. Prefer narrow per-rule exclusions over global ones.
Where this ends
These rules constrain behaviour on one machine. They do not tell you what is in your dependency tree. A scan such as Safeguard's free one at gold.safeguard.sh/scan answers a different question.
Quick check
Do ASR rules work on macOS?
No. Microsoft says ASR rules are a Windows feature and are not available on Linux or macOS.
What does audit mode do?
It evaluates the rule as if in block mode but takes no action, and records detections so you can review them.
Sources
Last reviewed: 19 October 2026.
