Dear Microsoft Security Friends,
In this article I will describe how I used the Microsoft Attack Surface Analyzer. I know this is absolutely nothing spectacular, but I would like to share my experience with you.
I have encountered the following situation at the customer:
A software provider had the order to install a new application on a server, so far everything was fine.
Immediately the additional information came that still some telemetry data are collected. And now I quickly became extremely alert. I asked, what kind of telemetry data? How is it collected, by means of an agent? No question was answered correctly and I knew immediately that the Attack Surface Analyzer would be used.
Let us now start with the setup of the Microsoft Attack Surface Analyzer.
1. We can find the tool on GitHub.
2. Navigate down to "Releases".
3. Klick on Tags.
4. Move down to the latest (not beta) version.
5. Download the (in my case the Windows Version) .zip file to the server where you want to run the scan.
6. Now extract the zip file.
7. Start a command prompt with elevated privileges and navigate to the folder with the extracted files. Enter the following: asa.exe gui
8. The browser starts and you are on the home page. Click on "Get Started".
9. Now we create the "before" scan, that is before the app is installed and whatever else is installed that we don't know. For "Scan Type" I have selected "Static Scan". At "Choose Collectors" select the options that are important for you (in this example I have selected all of them) and click "Collect Data".
10. After the app and other programs are installed, create a new scan exactly the same as in step 9.
11. Now we can compare the results. Click on "Results" at the top of the browser. For "Base Run Id" select the first scan and for "Product Run Id" select the second. On the left select a collector e.g. "Files" and we can see immediately what has changed on the system!
12. Klick on "Registry".
13. Klick on "Services".
14. Klick on "Firewall".
These were just a few examples. Of course, I invite you to examine the other collectors as well. But we have seen how great this tool is, it shows us exactly what changes have been made to the system by installing the software! Bingo!
I am absolutely aware that this is nothing spectacular. I just wanted to share a few impressions with you.
I hope this article was useful. Best regards, Tom Wechsler
Hi @TomWechsler, I have installed the latest version (2.3.277). The GUI is broken. I could see that the CSS resources are missing (Please see the image below). I have tried the older versions such as 2.2 but ended up with the same result. I have tried installing via "dotnet" and via manually downloading the zip file. I have tried to install it in windows 11. Could you please help me on this issue or point me somewhere I can get help?
Thanks in advance!
