Forum Discussion
How to check the events for Attack surface reduction in Audit mode using Advanced hunting
Hello Team, We have deployed ASR rules using Microsoft System Center Configuration Manager in audit mode. I found that the ASR events in audit mode can only be checked in Event logs by configuri...
I used this very simple advanced hunting search to find all events and then use the filters to drill into specific rules and amend the search timefrme.
DeviceEvents
| where ActionType startswith "Asr"
Each action type will include the rule and a status of Audited or Blocked. If you wanted to search for all audited events on Untrusted Executables for example you could amend search to:
DeviceEvents
| where ActionType == "AsrUntrustedExecutableAudited"
I found that there isn't always a need to exclude files listed in the audit before turning on block mode. I was able to turn on the LSASS Credential Theft rule for example without any exclusions being identified and I've had no complaints. Something to bear in mind if you find hundreds of audited events.
DeviceEvents
| where ActionType startswith "Asr"
Each action type will include the rule and a status of Audited or Blocked. If you wanted to search for all audited events on Untrusted Executables for example you could amend search to:
DeviceEvents
| where ActionType == "AsrUntrustedExecutableAudited"
I found that there isn't always a need to exclude files listed in the audit before turning on block mode. I was able to turn on the LSASS Credential Theft rule for example without any exclusions being identified and I've had no complaints. Something to bear in mind if you find hundreds of audited events.