Further reading
To go into even further detail about some of the ASR topics in this chapter, you can refer to the following online material:
- Read Microsoft’s announcement of (what was once called) Windows Defender Exploit Guard: microsoft.com/security/blog/2017/10/23/windows-defender-exploit-guard-reduce-the-attack-surface-against-next-generation-malware.
- Rudy Ooms MVP has some great insights into using Intune to harden Windows devices. You can read his article on CFA here, including a look under the hood at things such as events and registry entries: call4cloud.nl/2021/06/married-with-controlled-folder-accesscfa.
- For some insight into a wide-scale enterprise deployment approach for ASR rules, you can read about Palantir’s journey and insights: blog.palantir.com/microsoft-defender-attack-surface-reduction-recommendations-a5c7d41c3cf8.
- Jonathan Gregson has a great example of an exploit protection XML on GitHub, which combines Microsoft recommendations...
