{"id":1287,"date":"2018-05-05T11:51:22","date_gmt":"2018-05-05T09:51:22","guid":{"rendered":"https:\/\/hitco.at\/blog\/?p=1287"},"modified":"2018-05-05T11:52:43","modified_gmt":"2018-05-05T09:52:43","slug":"windows-defender-exploit-guard-attack-surface-reduction-rules","status":"publish","type":"post","link":"https:\/\/hitco.at\/blog\/windows-defender-exploit-guard-attack-surface-reduction-rules\/","title":{"rendered":"Windows Defender Exploit Guard &#8211; Attack Surface Reduction Rules aktivieren"},"content":{"rendered":"<p>Mit Windows 10 v1709 hat Microsoft der Defender-Plattform zus\u00e4tzliche, interessante Features spendiert, die nun mit Win10-Release 1803 um weitere M\u00f6glichkeiten erg\u00e4nzt wurden.<\/p>\n<p>So lassen sich zum Beispiel folgende Regeln aktivieren, welche das Risiko einer Malware-Infektion in einigen Szenarien deutlich reduzieren k\u00f6nnen:<\/p>\n<blockquote>\n<ul>\n<li>Block executable content from email client and webmail<\/li>\n<li>Block Office applications from creating child processes<\/li>\n<li>Block Office applications from creating executable content<\/li>\n<li>Block Office applications from injecting code into other processes<\/li>\n<li>Block JavaScript or VBScript from launching downloaded executable content<\/li>\n<li>Block execution of potentially obfuscated scripts<\/li>\n<li>Block Win32 API calls from Office macro<\/li>\n<li>Block executable files from running unless they meet a prevalence, age, or trusted list criteria<\/li>\n<li>Use advanced protection against ransomware<\/li>\n<li>Block credential stealing from the Windows local security authority subsystem (lsass.exe)<\/li>\n<li>Block process creations originating from PSExec and WMI commands<\/li>\n<li>Block untrusted and unsigned processes that run from USB<\/li>\n<\/ul>\n<\/blockquote>\n<p>Um sich einzulesen, startet man am besten mit der <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-exploit-guard\/attack-surface-reduction-exploit-guard\" target=\"_blank\" rel=\"noopener\">Dokumentation zur Attack Surface Reduction<\/a>. Hier werden die zur Verf\u00fcgung stehenden Regeln vorgestellt und erkl\u00e4rt. Anschlie\u00dfend widmet man sich dem Thema der <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-exploit-guard\/enable-attack-surface-reduction\" target=\"_blank\" rel=\"noopener\">Aktivierung der Regeln<\/a>, hier sind unter anderem GroupPolicies oder PowerShell die Mittel der Wahl (ein Anwender-GUI existiert hierzu derzeit nicht).<\/p>\n<p>Ein Sample-Script um einige (aus meiner Sicht recht sinnvolle) Attack-Surface-Reduction Regeln zu aktivieren habe ich in meinem GitHub Repo bereitgestellt:&nbsp;<a href=\"https:\/\/github.com\/gunnarhaslinger\/Windows-Defender-Exploit-Guard-Configuration\/blob\/master\/Enable-ExploitGuard-AttackSurfaceReduction.ps1\" target=\"_blank\" rel=\"noopener\">Enable-ExploitGuard-AttackSurfaceReduction.ps1<\/a><\/p>\n<p>Einige der Regeln k\u00f6nnen au\u00dferdem mit Ausnahmen versehen werden. Dies ist beispielsweise n\u00f6tig, um einzelne Anwendungsf\u00e4lle die ein auff\u00e4lliges\/geblocktes Szenario zeigen dennoch zuzulassen &#8211; erl\u00e4utert wird dies im <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-exploit-guard\/customize-attack-surface-reduction\" target=\"_blank\" rel=\"noopener\">Customizing Teil der Dokumentation<\/a>.<\/p>\n<p>Um das &#8222;Look and Feel&#8220; einer solchen Blockierung kennenzulernen bzw. zu pr\u00fcfen, kann man sich mit Hilfe einer <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-defender-exploit-guard\/evaluate-attack-surface-reduction\" target=\"_blank\" rel=\"noopener\">Demo-Applikation im Exploit Guard Evaluation Package<\/a>&nbsp;hiervon einen Eindruck verschaffen.<\/p>\n<figure id=\"attachment_1288\" aria-describedby=\"caption-attachment-1288\" style=\"width: 635px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-1288\" src=\"https:\/\/hitco.at\/blog\/wp-content\/uploads\/Defender-Exploit-Guard-Attack-Surface-Reduction.png\" alt=\"Windows Defender Exploit-Guard - Attack-Surface Reduction\" width=\"635\" height=\"666\" srcset=\"https:\/\/hitco.at\/blog\/wp-content\/uploads\/Defender-Exploit-Guard-Attack-Surface-Reduction.png 635w, https:\/\/hitco.at\/blog\/wp-content\/uploads\/Defender-Exploit-Guard-Attack-Surface-Reduction-286x300.png 286w, https:\/\/hitco.at\/blog\/wp-content\/uploads\/Defender-Exploit-Guard-Attack-Surface-Reduction-80x84.png 80w\" sizes=\"auto, (max-width: 635px) 100vw, 635px\" \/><figcaption id=\"caption-attachment-1288\" class=\"wp-caption-text\">Windows Defender Exploit-Guard &#8211; Attack-Surface Reduction<\/figcaption><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Mit Windows 10 v1709 hat Microsoft der Defender-Plattform zus\u00e4tzliche, interessante Features spendiert, die nun mit Win10-Release 1803 um weitere M\u00f6glichkeiten erg\u00e4nzt wurden. So lassen sich zum Beispiel folgende Regeln aktivieren, welche das Risiko einer Malware-Infektion in einigen Szenarien deutlich reduzieren k\u00f6nnen: Block executable content from email client and webmail Block Office applications from creating child processes Block Office applications from&#8230; <\/p>\n","protected":false},"author":1,"featured_media":1288,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"ngg_post_thumbnail":0,"footnotes":""},"categories":[3,4,12],"tags":[216,193,218,217,131],"class_list":["post-1287","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-it","category-security","category-virenschutz","tag-attack-surface-reduction","tag-exploit-guard","tag-konfiguration","tag-powershell","tag-windows-defender"],"_links":{"self":[{"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/posts\/1287","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/comments?post=1287"}],"version-history":[{"count":5,"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/posts\/1287\/revisions"}],"predecessor-version":[{"id":1293,"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/posts\/1287\/revisions\/1293"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/media\/1288"}],"wp:attachment":[{"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/media?parent=1287"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/categories?post=1287"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hitco.at\/blog\/wp-json\/wp\/v2\/tags?post=1287"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}