Evaluate attack surface reduction rules
Attack surface reduction rules help prevent actions that are typically used by malware to compromise devices or networks. You can set attack surface reduction rules for devices running any of the following editions and versions of Windows:
- Windows 10 Pro, version 1709 or later
- Windows 10 Enterprise, version 1709 or later
- Windows Server, version 1803 (Semi-Annual Channel) or later
- Windows Server 2019
Learn how to evaluate attack surface reduction rules, by enabling audit mode to test the feature directly in your organization.
You can also visit the Windows Defender Testground website at demo.wd.microsoft.com to confirm the feature is working and see how it works.
Use audit mode to measure impact
You can enable attack surface reduction rules in audit mode. This lets you see a record of what apps would have been blocked if you had enabled attack surface reduction rules.
You might want to do this when testing how the feature will work in your organization, to ensure it doesn't affect your line-of-business apps, and to get an idea of how often the rules will fire during normal use.
To enable all attack surface reduction rules in audit mode, use the following PowerShell cmdlet:
Set-MpPreference -AttackSurfaceReductionRules_Actions AuditMode
If you want to fully audit how attack surface reduction rules will work in your organization, you'll need to use a management tool to deploy this setting to machines in your network(s).
You can also use Group Policy, Intune, or MDM CSPs to configure and deploy the setting, as described in the main Attack surface reduction rules topic.
Review attack surface reduction events in Windows Event Viewer
To review apps that would have been blocked, open Event Viewer and filter for Event ID 1121 in the Microsoft-Windows-Windows Defender/Operational log. The following table lists all network protection events.
|5007||Event when settings are changed|
|1121||Event when an attack surface reduction rule fires in block mode|
|1122||Event when an attack surface reduction rule fires in audit mode|
Customize attack surface reduction rules
During your evaluation, you may wish to configure each rule individually or exclude certain files and processes from being evaluated by the feature.
See the Customize attack surface reduction rules topic for information on configuring the feature with management tools, including Group Policy and MDM CSP policies.