Question

Your organization plans to deploy Microsoft Defender for Endpoint attack surface reduction (ASR) rules to block credential stealing from LSASS. The security team is concerned that enabling the rule in Block mode immediately could disrupt legitimate line-of-business applications. What is the recommended first step to safely evaluate the impact of this ASR rule across the environment?

Accepted Answer

Configure the ASR rule in Audit mode and review the generated events before switching it to Block mode

Answer

Enable the ASR rule in Block mode but add all existing applications to the exclusion list

Answer

Enable the ASR rule in Warn mode so users can choose whether to bypass the block

Answer

Deploy the rule in Block mode to a single pilot device group and monitor Defender for Endpoint alerts