Blog Post

Microsoft Defender for Endpoint Blog

6 MIN READ

Demystifying attack surface reduction rules - Part 1

Iron Contributor

Apr 14, 2020

Hey everyone! António and Rob here! For the past few years, we’ve been working closely with many of our customers, assisting them in their journeys toward adopting the full Microsoft Defender A...

Updated Apr 22, 2020

Version 7.0

Demystifying ASR rules

Antonio Vasconcelos

Iron Contributor

Joined September 19, 2017

View Profile

Microsoft Defender for Endpoint Blog

Microsoft Defender for Endpoint disrupts ransomware with industry-leading endpoint security, providing comprehensive protection across all platforms and devices.

Antonio Vasconcelos

Iron Contributor

May 14, 2020

Deleted

Today ASR rules report in M365 SCC incorrectly shows LSASS.EXE has the culprit for triggering the alert.

If you use Advanced Hunting you'll be able to see what is the InitiatingProcess, that triggered the LSASS ASR rule.

As for Teams.exe, please test in block mode. If it's really blocked, please report in WDSI. What specific action where you doing? Opening a Teams meeting via a link in an e-mail?

Thanks!