Building a tamper-resilient endpoint with Microsoft Intune and Microsoft Defender

Event details

Come listen to Matt and Josh talk about how secure endpoint configurations fit into your zero trust strategy. They'll describe the overall landscape, how to unify your configurations into a single so...

Heather_Poulsen

Updated Dec 27, 2024

Technical Takeoff

Greg Stein

Brass Contributor

Oct 26, 2022

Which of the 16 ASR rules are considered "standard" that was recommended to get started with?

Greg Stein

Brass Contributor

Oct 26, 2022

Found an article in case anyone else is looking for this info: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#attack-surface-reduction-rules-by-type

JoshBregman
Microsoft
Nov 03, 2022
Standard rules are:

Block abuse of exploited vulnerable signed drivers

Block credential stealing from the windows local security authority subsystem (lsass.exe)

Block persistence through WMI event subscription