Attack surface reduction (ASR) rules: every rule name, GUID, event ID and Intune setting

An ASR block on a device rarely names the rule in plain words: Event Viewer gives you a GUID, advanced hunting gives you an ActionType, and Intune shows a friendly name. This quick reference maps all three for every attack surface reduction rule Microsoft documents, with the mode values, the events to look for and the first thing to check when a rule blocks something it shouldn't.

How to read these codes#

ASR rules are a Microsoft Defender Antivirus feature on Windows only; they don't exist on macOS or Linux. They work only when Defender Antivirus is the active antivirus with real-time protection on: passive mode, EDR in block mode, limited periodic scanning and Off all switch them off. Cloud-delivered protection matters too, because several rules depend on it.

• GUID: how every method except the Intune and Configuration Manager consoles identifies a rule: Group Policy value names, the Policy CSP string, Get-MpPreference and the event text of 1121, 1122 and 1129.
• ActionType: the advanced hunting name in the DeviceEvents table, ending in Audited, Blocked or, for two rules, WarnBypassed. Advanced hunting needs Defender for Endpoint Plan 2.
• Intune name: the setting in an endpoint security Attack Surface Reduction Rules profile. Configuration Manager names differ for a few rules (noted below).

To see what a device actually received, list its rules and modes:

$p = Get-MpPreference
for ($i = 0; $i -lt $p.AttackSurfaceReductionRules_Ids.Count; $i++) {
    [pscustomobject]@{
        Id   = $p.AttackSurfaceReductionRules_Ids[$i]
        Mode = $p.AttackSurfaceReductionRules_Actions[$i]
    }
}

Rule modes#

Warn needs Windows 10 version 1809 or later and isn't available in Configuration Manager; on older Windows it behaves like Block. Two rules don't support it (marked below). From Defender platform version 4.18.26060, Unblock requires administrator approval, so use a per-rule exclusion when you need a lasting exception.

The rules: GUIDs and action types#

Standard protection rules#

Microsoft recommends Block for these three without lengthy testing.

Other rules#

Add Audited or Blocked to the prefix to get the full ActionType, for example AsrLsassCredentialTheftBlocked. Configuration Manager calls the prevalence rule "...trusted list criteria" and can't deploy the vulnerable signed drivers, WMI persistence, Adobe Reader, Office communication application, PSExec and WMI, Safe Mode, copied system tools or Webshell rules.

Event IDs in Event Viewer#

ASR events are in Applications and Services Logs › Microsoft › Windows › Windows Defender › Operational, next to the events of the other attack surface reduction features.

Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-Windows Defender/Operational'
    Id      = 1121, 1122, 1129
} -MaxEvents 50 | Select-Object TimeCreated, Id, Message | Format-List

Microsoft also publishes an asr-events.xml custom view for Event Viewer. For the rest of the Defender Antivirus events, see the Defender Antivirus event ID quick reference.

Where each method sets the rules#

When methods collide, Group Policy beats local PowerShell settings and, by default, MDM too, unless MDMWinsOverGP is set to 1 through the Policy CSP. Configure each rule in one place only.

How to verify a fix#

1. Sync the device, then look for event 5007 and run the Get-MpPreference loop above: the GUID should show the mode you set.
2. Repeat the action that was blocked. After an exclusion, a restart of the excluded app or service may be needed, because exclusions apply when it starts.
3. In advanced hunting, confirm the hits stop (or still appear only as Audited):

DeviceEvents
| where Timestamp > ago(7d)
| where ActionType startswith "Asr"
| summarize Hits = count() by ActionType, DeviceName, FileName, InitiatingProcessFileName
| order by Hits desc

On a single device, the device page's Timeline tab can be filtered to ASR events. For rollout strategy and exclusions, see Rolling out ASR rules safely.

References#

• Attack surface reduction (ASR) rules reference (source of the rule table)
• Configure attack surface reduction (ASR) rules and exclusions
• Attack surface reduction events in Windows Event Viewer