Understanding ASR rules
ASR rules restrict system behaviors often used by attackers, whether the intent is malicious or not.
By taking the determination of intent out of the equation, you significantly harden the device, albeit with the potential for disruption if legacy activities are still performed. Fortunately, you can plan for that disruption by deploying ASR rules in Audit mode (2) to review the scale of the problem before applying the rules in Block mode (1) or Warn mode (6). Warn mode, available for most but not all ASR rules since Windows 10 1809, allows the user to override the block for 24 hours at a time.
As general guidance, these three modes for ASR rules combined make a deployment road map:
- Start in Audit mode, leveraging the data that clients produce to understand what problems may present themselves when enabled
- After mitigating problems identified in Audit mode, or accepting the risks, proceed to Warn mode so that users can proceed without breaking...
