Building a tamper-resilient endpoint with Microsoft Intune and Microsoft Defender

Event details

Come listen to Matt and Josh talk about how secure endpoint configurations fit into your zero trust strategy. They'll describe the overall landscape, how to unify your configurations into a single so...

Heather_Poulsen

Updated Dec 27, 2024

Technical Takeoff

Greg Stein

Brass Contributor

Oct 26, 2022

Which of the 16 ASR rules are considered "standard" that was recommended to get started with?

Greg Stein
Brass Contributor
Oct 26, 2022
Found an article in case anyone else is looking for this info: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#attack-surface-reduction-rules-by-type
- JoshBregman
  Microsoft
  Nov 03, 2022
  Standard rules are:
  
  Block abuse of exploited vulnerable signed drivers
  
  Block credential stealing from the windows local security authority subsystem (lsass.exe)
  
  Block persistence through WMI event subscription