Attack Surface Reduction Rules – Warn Mode with MEM/M365 Defender

by Contributed | Mar 18, 2021 | Technology

This article is contributed. See the original author and article here.

Introduction 

 
This is John Barbare and I am a Sr Customer Engineer at Microsoft focusing on all things in the Cybersecurity space. In a previous blog back in July, 2020, I walked through a demo of setting up an Attack Surface Reduction (ASR) rule policy in Microsoft Endpoint Manager (MEM) for your Windows Operating Systems and how to view the detections once applied. 

Since then, Microsoft has introduced a new “Warn Mode” in addition to the Audit and Block modes previously. With that said, I will give a brief overview of ASR Rules, demo what the differences are in the different modes, show custom security notifications for your organization, and the hunt for ASR rule alerts in the new Microsoft 365 Defender unified portal. 

What are Attack Surface Reduction Rules? 

Attack surface reduction rules help prevent software behaviors that are often abused to compromise your device or network. For example, an attacker might try to run an unsigned script off a USB drive, or have a macro in an Office document make calls directly to the Win32 API. ASR rules can constrain these kinds of risky behaviors and improve your organization’s defensive posture to decrease your risk considerably from being attacked with Ransomware, various other types of malware, and other attack vectors.  

If you are evaluating or executing a proof of concept from a 3rd party HIPS (Host Intrusion Prevention System) over to ASR rules, this article will assist you in the planning, development, and proper configuration in MEM. With the complete end to end protection Microsoft offers, this article will focus on the Attack Surface Reduction component of Windows Defender Exploit Guard. Prevent actions and apps that are commonly used by malware, such as launching executables from email (.exe, .dll, .scr, .ps, .vbs, and .js).

• Scripts or applications that launch child processes 


• Most rules can be set to Audit to monitor activity prior to being set to enforce 


• All rules support exclusions based on file or folder names 


• ASR rules support environmental variables and wildcards 
   

ASR rules may block legitimate applications from making changes, so these features come with both an Audit mode and a Block mode and a newly released Warn mode. I always recommend to my customers when configuring ASR rules for the first time to conduct the changes in Audit mode first so it will allow for testing of the policy before moving any of the rules into Block mode. But now we can audit, then warn, before placing into block mode so our users know that a risky behavior is being detected. This is exactly like using SmartScreen where the user goes to website that is malicious, and is warned but given the choice to bypass or not continue at all. This is great before rolling out a new feature and will provide some great context around the warn mode feature.  

Warn mode  

With the new warn mode, whenever content is blocked by an ASR rule, users see a dialog box that indicates the content is blocked. The dialog box also offers the user an option to unblock the content. The user can then retry their action, and the operation completes. When a user unblocks content, the content remains unblocked for 24 hours, and then blocking resumes. Warn mode helps your organization have ASR rules in place without preventing users from accessing the content they need to perform their tasks. 

Supported OS for Warn Mode and Requirements 

Warn mode is supported on devices running the following versions of Windows OS: 

• Windows 10, version 1809 or later 


• Windows Server, version 1809 or later 

Microsoft Defender Antivirus must be running with real-time protection in Active mode. 

In addition, make sure Microsoft Defender Antivirus and antimalware updates are installed. 

• Minimum platform release requirement: 4.18.2008.9 


• Minimum engine release requirement: 1.1.17400.5 

Exceptions to Warn Mode 

The following three ASR rules are not supported in Warn Mode: 

1. Block JavaScript or VBScript from launching downloaded executable content (GUID d3e037e1-3eb8-44c8-a917-57927947596d) 


2. Block persistence through WMI event subscription (GUID e6db77e5-3df2-4cf1-b95a-636979351e5b)


3. Use advanced protection against ransomware (GUID c1db55ab-c21a-4637-bb3f-a12568109d35) 

In addition, warn mode is not supported on devices running older versions of Windows. In those cases, ASR rules that are configured to run in warn mode will run in block mode. 

Setting up Warn Mode Using Microsoft Endpoint Manager 

 
The first item we want to do is make sure that all the devices we want to push the new ASR rule policy are showing up inside MEM admin center. This paper assumes you have enrolled all the devices for your preferred method, and we are checking to make sure the devices are shown before creating or pushing out a new policy. Navigate to the Microsoft Endpoint Manager admin center and login with your credentials. Once logged in you will arrive at the home page. 

MEM Home

Select “Devices” and then “All devices” to make sure the device you will be applying the new ASR rule Policy has been synchronized. 

All Devices Page

Next, we will select the “Endpoint Security” tab which is under the “Device” tab. 

Endpoint Security Home

This will bring you into the main policy dashboard to create the new ASR Warn rule policy. First you will select “Attack Surface Reduction” under the “Manage” tab. Select “create policy” at the top, and then a window will open to pick the operating system “Platform” and “Profile”. For “Platform”, select Windows 10 and later and for “Profile”, select Attack Surface Reduction Rules and click “Create” at the bottom.  

Creating the Profile/Policy

This will bring you to the creation of the profile for ASR. Name the profile in the “basics” tab and then provide a brief description and click next. 

Name the Profile

Configuration Settings 

The next tab, “Configuration settings” is where you will configure the ASR rules. Here we have placed all the ASR rules in warn except the ones that are not allowed. From selecting the third ASR rule, one can see all the settings for the rule including the new Warn mode. You can also search for a setting in the top box underneath the settings and before the ASR rules. After placing them in the correct mode, select next.  

Selecting Warn Mode for the ASR Rule Policy

Assignments 

Next, we will have the option to assign the policy to select groups, all users, all devices, or all users and devices. Here we are targeting just a select group and will pick the IT Group for this new policy. Selecting the groups to include and IT Group will target the devices inside the group and then click select and then click next. This is the equivalent to applying a policy to an organizational unit in Group Policy Objects.  

Adding Assignments

Many users ask when to use user groups and when to use device groups. The answer depends on your goal. Use device groups when you do not care who is signed in on the device, or if anyone is signed in. You want your settings to always be on the device. Use user groups when you want your settings and rules to always go with the user, whatever device they use. 

Review and Create 

Now let’s head over to finalizing up the newly created profile on the review and create profile page. You will see all the settings for our new Warn ASR policy, and you can confirm before selecting create. Go ahead and click on create to save the new ASR policy. 

Creating the Profile

 The next page will bring you to the summary page where you can view the new ASR rule policy you just created. When you select the policy name that you have created, you will be redirected to the overview page which will display more detailed information. 

Viewing the new Profile

When you select a tile from this view, MEM displays additional details for that profile if they are available. In this case, it applied my new ASR Rule Warn Mode policy to my lab test machine that I targeted successfully.  

Profile Synced to Targeted Machine

Testing Out the New Warn Mode 

In my lab, I will test out one of the rules to show you what Warn mode looks like when triggering an ASR Rule with my newly applied ASR Warn mode policy. In the first instance I have a malicious Microsoft Word Document that will create multiple child processes. As seen below, I open the document and then bypass the security warning and click on Enable Content. 

Bypassing Security Warning

After bypassing the alert, a Windows Security notification is presented with a dialog box that indicates the content is blocked. The dialog box also offers me the new option to unblock the content. The dialog box below has been increased in size to show you the full warning.  

Warn Mode Notification

If the ASR Policy would have been in Block mode, the below dialog box would have been presented to the user.  

Block Mode Notification

As one can see during testing or implementation of ASR Rules, you can see the real value of using Warn mode versus going strait to Audit and then full Block mode. This way you can let your users know you will be implementing a new security policy and they will be warned before full implementation. 

Customizing the Dialog Box 

If your organization wants to display a customized notification from Windows Security to display options to call, email, or redirect the user to a help portal, the instructions can be found here. I will not walk through the steps, but the screenshot below depicts what a customized notification would look like when an ASR Rule or any other Windows Security notification is displayed.  

Customized Dialog Box from Defender

Advanced Hunting with ASR Rules in Microsoft 365 Defender 

Microsoft Defender 365 provides detailed reporting for events as part of its alert investigation scenarios. You can query Microsoft Defender 365 data by using advanced hunting using KQL (Kusto Query Language).  Login into Microsoft 365 Defender and select Hunting and then Advanced Hunting blade at the top. The query we will run is the following: 

DeviceEvents 

| where ActionType startswith ‘Asr’ 

Advanced Hunting for ASR Triggers

Monitoring the ASR Rules in Microsoft 365 Defender 

In the same window, select Configuration Management blade under Endpoints and then select Go to Attack Surface Management. Select the detections tab to see a more fine-grained ASR rule detection graph in Audit and Block mode over a period time and what has been detected.  

Microsoft 365 Defender ASR Rule Line Chart Triggers

Conclusion 

 
Thanks for taking the time to read this article and I hope you understand the new Warn mode for ASR rules and how you can use it in your organization during testing and pre-implementation. Using the new unified portal – Microsoft Defender 365 – to hunt for ASR detections and see a graph of what is getting triggered will further show the value for any IT Manager the value of the Microsoft 365 security stack. Hope to see you in the next blog and always protect your endpoints! 

Thanks for reading and have a great Cybersecurity day! 

Follow my Microsoft Security Blogs: http://aka.ms/JohnBarbare  and  also on LinkedIn. 

[Guest Blog] Human Touch with Microsoft Teams

by Contributed | Mar 17, 2021 | Technology

This article is contributed. See the original author and article here.

This blog is written by Mario Trentim as a part of our Humans of IT guest blogger series. Mario has a passion for creativity, problem solving, continuous improvement and technology. He shares his best practices to adding a human touch to your remote experience on Microsoft Teams. 

I delivered a webinar about team building and teamwork. To my surprise, I got a lot of comments mentioning that it is challenging to engage with colleagues virtually. People even mentioned that we are losing touch with our human side because of technology. What are your thoughts on this, especially as we’ve shifted to remote work? 

As we’ve all experience remote work now and picked up a tip or two, we know virtual meetings do not have to be boring, inflexible, impersonal neither meetings have to be always “straight to the point.” It is important to know that if you feel disconnected from your coworkers, you can make a change in the way you’re conducting or participating in meetings, and ultimate, it’s on you. The technology is “just” a tool.

In this article, I bring some tricks and tricks to engage and motivate coworkers using Microsoft Teams. Please read on if this is relevant to you. 

By working in a physical space, you have the chance to approach your colleagues in various ways. You meet informally at the cafeteria, you have lunch together. You can walk across the office and ask for help or chat about personal topics.

Working from home and moving to virtual-only meetings, are we sentenced to behave like machines? The answer is no.

It is on you and your team to build productive habits. To be a valuable team member, it is essential that you:

• Participate actively in the discussions;


• Provide feedback; 


• Be empathetic.

As we reflect on the principles above, we can come up with simple behaviors for our daily virtual meetings and teamwork collaboration. Let’s start with virtual meetings:

1) Turn on your camera;
2) Take a few minutes to talk about personal topics;
3) Pay attention to people’s reactions and ask questions;
4) Take notes, paraphrase, and summarize.

I discovered that by changing my Microsoft Teams’ background can spark interesting warm-up conversations. I use photos from the places I visited, sometimes cartoons or movie scenes.

Warming-up questions are a cornerstone of every meeting. Ask direct questions about hobbies, family, or other appropriate topics. For example, “How is Ana doing with homeschooling?”, “Is your dog okay?”, “Did you had a chance to go for a run yesterday?”. Well, use your imagination.

It is not a chore. You have to be genuinely interested in the other person. Start doing that, and you will feel better.

Multi-tasking and half-hearted attention are obstacles to productivity and team morale. Avoid them at all costs. To get people focused, ask questions, engage people, summarize.

By using Microsoft Teams, I take full advantage of collaboration with Microsoft Whiteboard. It is an engaging and fun process.

Finally, don’t forget to define action plans and owners. Assigning responsibility and following up on decisions is a final touch on team motivation. In the physical office, we could have those Post-It notes.

You can do the same with Microsoft Teams by using Lists or Planner. Visually tracking goals and activities is another tool for engagement and motivation.

Hope that this article was a reminder of the human touch we’re are all capable of having from our homes. As we are all now well-versed in remote work, what other suggestions do you have? Share in the comments below!

Teams Meeting Recording Diagnostic in Microsoft Remote Connectivity Analyzer

by Contributed | Mar 17, 2021 | Technology

This article is contributed. See the original author and article here.

Hi Teams Community,

We’re back with another addition to Support Diagnostics for Microsoft Teams.  @João Loureiro has written our third offering in the Microsoft Remote Connectivity Analyzer, the Meeting Recording test.   

This new Diagnostic will help you troubleshoot and test if you meet requirements to record a Teams meeting.  If you recently attempted to record a Teams meeting or group call and you were unable to, for example the Recording button was greyed out, you should use this diagnostic to help you troubleshoot.  

To access the new diagnostic, navigate to Microsoft Remote Connectivity Analyzer, select Microsoft Teams, then click on the Teams Meeting Recording Test.  

You’ll need to enter valid credentials of an affected account. Optionally you can specify the Teams Meeting URL you are planning to record. Keep in mind your end users can also perform these tests, you do not need to be an Administrator of your tenant.  In some scenarios you’ll want to work with your impacted end user to run the tests and collect additional data for Microsoft Support.  

At a high level the test checks a couple things:

• The user is licensed and fully provisioned for Teams


• The user is enabled for cloud meeting recording


• Recordings saved to OneDrive for Business and SharePoint or Microsoft Stream


• If recordings configured to use Stream will check if user is within valid region for streaming


• The user as permissions to record provided Teams Meeting URL

You’ll also want to go over the following documents carefully when configuring Teams cloud meeting recording

Teams cloud meeting recording

Use OneDrive for Business and SharePoint or Stream for meeting recordings

Record a meeting in Teams

Please give the new diagnostic a try if you’re having trouble with Teams Meetings Recording and let us know if it helped?

Thanks!
Microsoft Teams Support

Cannot Replicate Stored Procedure Execution when CDC is enabled

by Contributed | Mar 17, 2021 | Technology

This article is contributed. See the original author and article here.

With Transactional Replication you can replicate execution of the Stored Procedure like this:

This has several advantages as discussed in this article:

https://docs.microsoft.com/en-us/sql/relational-databases/replication/transactional/publishing-stored-procedure-execution-in-transactional-replication?view=sql-server-ver15

When you enable CDC at the Database level, replication of the stored procedure execution will NOT work. This is By Design. CDC does not support tracking at stored procedure execution level, which means individual rows logged by stored proc execution need to be flagged with REPLICATE bit, which makes it impossible for transactional replication to replicate stored proc execution.  As a result, ‘stored proc execution’ will work only when transactional replication is enabled and CDC is disabled.