d4f940ab-401b-4efc-aadc-ad5f3c50688a
Child process creation ASR rule

d4f940ab-401b-4efc-aadc-ad5f3c50688a Child process creation ASR rule

Child process creation ASR rule

https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39




in execution. If an environment doesn’t have any Attack Surface Reduction rules enabled, this is all an attacker needs to execute code on the endpoint. I was curious, so I poked at how this holds up with ASR’s child process creation rules enabled. It is also worth noting that at of the time of this post, ASR rules do not appear to work on Office if Office was installed from the Windows Store.

Enabling these rules is pretty simple, and can be done with one PowerShell command: “Set-MpPreference -AttackSurfaceReductionRules_Ids <rule ID> -AttackSurfaceReductionRules_Actions Enabled”

The <rule ID> parameter is the GUID of the rule you want to enabled. You can find the GUID for each ASR rule documented here. For this test, I want to enable the Child Process Creation rule, which is GUID D4F940AB-401B-4EFC-AADC-AD5F3C50688A.
7 Specterops