Summary
In this chapter, we dove into ASR, and you found out how to lower the likelihood of exploits and risk of vulnerabilities. You learned about how ASR, originally branded Exploit Guard, is comprised of four core features: ASR rules, controlled folder access, exploit protection, and network protection.
To recap, ASR rules are individually defined options that audit or prohibit (including the option to override) certain types of operations, such as Office applications creating child processes or running obfuscated scripts. CFA is primarily a ransomware protection feature that protects user folders from malicious applications of all kinds. Exploit protection lives on from the EMET to defend against potential OS and app exploits. Last of the four ASR features, network protection, guards the network layer against low reputation, C2, and exploitation. It powers the ability of MDE to block web content and sits alongside SmartScreen as a defense against low-reputation resources.
...
