Microsoft Defender Attack Surface Reduction

Microsoft Intune Endpoint Security + Attack Validation

A hands-on Microsoft lab demonstrating how Attack Surface Reduction rules can reduce credential-theft and Office-based attack paths.

Lab environment: This project was completed independently in a personal Microsoft lab. All identities, devices and configuration details are lab data.

Project Summary

Area	Implementation
Business requirement	Reduce common endpoint attack techniques
Management platform	Microsoft Intune
Security control	Defender Attack Surface Reduction
Protected activity	Credential access and Office child processes
Validation method	PowerShell, Defender telemetry and ProcDump

Architecture

flowchart TD
    A["Intune Endpoint Security"] --> B["ASR policy"]
    B --> C["Managed Windows device"]
    C --> D["LSASS credential protection"]
    C --> E["Office child-process blocking"]
    F["ProcDump test"] --> C
    C --> G["Defender blocks activity"]

Loading

Scenario

Attackers frequently abuse Office applications and credential-access techniques after gaining initial access. This project tested centrally managed ASR rules and validated whether selected malicious or high-risk behaviours were blocked.

What I Implemented

ASR Policy

• Created an Attack Surface Reduction policy through Intune Endpoint Security
• Configured selected rules in Block mode
• Enabled protection against credential theft from LSASS
• Blocked Office applications from creating child processes

Deployment and Testing

• Assigned the policy to managed Windows devices
• Verified applied rules using PowerShell
• Reviewed Microsoft Defender telemetry
• Used Sysinternals ProcDump to test credential-dumping protection

Validation Results

Test	Expected result	Observed result
Query ASR configuration	Selected rules report Block mode	Rules confirmed
Attempt protected credential-dumping activity	Defender blocks the action	Activity blocked
Review security telemetry	Protection event is recorded	Event recorded

Outcome

The lab validated that Intune-managed ASR rules were active on the endpoint and could block a tested credential-access technique, demonstrating preventative endpoint hardening rather than configuration alone.

Skills Demonstrated

• Microsoft Defender Antivirus
• Attack Surface Reduction
• Microsoft Intune
• Endpoint Security
• PowerShell validation
• Defender telemetry
• Sysinternals ProcDump
• Attack simulation

Technical Documentation

View the full technical documentation (PDF)

---

Return to Guy Cheneval's GitHub profile