AddDefenderPolicies.Policies.AddDefenderPolicies• Machine

Block credential stealing from the Windows local security authority subsystem (lsass.exe)

This rule helps prevent credential stealing by blocking code injection attempts targeting lsass.exe. Enabling this rule doesn't provide additional protection if you have LSA protection enabled since the ASR rule and LSA protection work similarly. However, when LSA protection cannot be enabled, this rule can be configured to provide equivalent protection against malware that target lsass.exe.

Policy Details

Policy Name: ExploitGuard_ASR_Rules_Lsass
Registry Key: Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
Supported On: At least Windows Server 2016, Windows 10 Version 1803
Available Languages: en-us fr-fr

Configuration Elements

ASR rule modes: Not configured or Disable: The state in which the ASR rule isn't enabled. Block: The state in which the ASR rule is enabled. Audit: The state in which the ASR rule is evaluated for the effect it would have on the organization or environment if enabled (set to block or warn). Note: The Block credential stealing from the Windows local security authority subsystem ASR rule doesn't support WARN mode.

Mode:

Type: enum

Allowed Values

0 Disabled
2 Audit
1 Block