Defender - Attack Surface Reduction
Enterprise
ESM Security Setting - Block abuse of exploited vulnerable signed drivers (Device)
Description: This rule prevents an application from writing a vulnerable signed driver to disk. In-the-wild, vulnerable signed drivers can be exploited by local applications - that have sufficient privileges - to gain access to the kernel. Vulnerable signed drivers enable attackers to disable or circumvent security solutions, eventually leading to system compromise. The Block abuse of exploited vulnerable signed drivers rule does not block a driver already existing on the system from being loaded.
Why It's Important: Some attackers use legitimate but vulnerable drivers—those that are signed but have known security flaws—to gain deep access to a system. These drivers can be exploited to disable antivirus tools or take control of the operating system. This setting blocks applications from writing those risky drivers to disk, helping prevent attackers from using them to bypass security. SHIELD enables this policy to stop one of the stealthiest and most dangerous attack techniques. It’s like refusing to install a tool that looks official but has a known backdoor—keeping the system protected from the inside out.
Learn More
ESM Security Setting - Adobe Reader Child Processes Policy
Description: This rule prevents attacks by blocking Adobe Reader from creating additional processes.
Why It's Important: Attackers sometimes use malicious PDF files to make Adobe Reader launch other programs in the background—like command-line tools or scripts that install malware. This technique is often used in phishing attacks or drive-by downloads. This setting blocks Adobe Reader from creating those background processes, cutting off a common method used to exploit PDF files. SHIELD enables this policy to stop threats before they can execute, especially in environments where PDFs are frequently used. It’s like preventing a document viewer from secretly opening a backdoor—keeping your system secure from hidden threats.
Learn More
ESM Security Setting - All Office Apps Communication Child Processes Policy
Description: This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access.
Why It's Important: Attackers often use malicious Office documents—like Word or Excel files—to launch other programs in the background, such as PowerShell or command-line tools. This technique is commonly used in phishing attacks to silently install malware or steal data. This setting blocks Office apps from launching those background processes, cutting off one of the most exploited attack paths. SHIELD enables this policy to stop threats before they can execute, especially in environments where Office documents are frequently used. It’s like preventing someone from using a trusted tool to open a hidden backdoor—keeping your system secure from the inside out.
Learn More
ESM Security Setting - Credential Theft from LSASS Policy
Description: This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS).
Why It's Important: The Local Security Authority Subsystem Service (LSASS) stores sensitive information like usernames and passwords in memory. Attackers often target LSASS to steal credentials and move laterally across a network. This setting blocks attempts to access LSASS in unauthorized ways, helping prevent credential theft and privilege escalation. SHIELD enables this policy to protect one of the most critical parts of the Windows security system. It’s like locking down the vault where all the keys are stored—keeping attackers from getting the tools they need to spread.
Learn More
ESM Security Setting - Executable Content from Email and Webmail Policy
Description: This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers: Executable files (such as .exe, .dll, or .scr), Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file).
Why It's Important: Email is one of the most common ways attackers deliver malware—often through attachments or links that download executable files or scripts. These files can silently install ransomware, spyware, or other threats when opened. This setting blocks those risky file types from running if they come from email clients like Outlook or webmail services. SHIELD enables this policy to stop threats before they can launch, especially from phishing emails. It’s like refusing to open unknown packages delivered to your inbox—keeping your system safe from hidden dangers.
Learn More
ESM Security Setting - Executable Files Criterion Policy
Description: This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list: Executable files (such as .exe, .dll, or .scr).
Why It's Important: Attackers often use new or uncommon executable files to bypass traditional antivirus tools. These files may not yet be recognized as malicious but can still pose a serious threat. This rule helps detect such files by checking whether they are widely used, have been around long enough, or are on a trusted list. Setting this rule to Audit allows security teams to monitor how often these types of files are launched without blocking them yet. SHIELD enables this policy in audit mode to gather insights and prepare for stricter enforcement. It’s like watching who enters a secure area with unfamiliar credentials—so you can decide later whether to allow or block them.
Learn More
ESM Security Setting - Block Obfuscated Scripts Policy
Description: This rule detects suspicious properties within an obfuscated script.
Why It's Important: Obfuscated scripts are often used by hackers to hide malware. This setting helps Defender spot those suspicious scripts and report them, without blocking them yet—so IT teams can see what would happen if the rule were fully enforced. SHIELD uses audit mode to safely test the rule’s impact before switching to full protection. It’s like watching how often someone tries to sneak in before deciding to lock the door—smart, cautious, and data-driven.
Learn More
ESM Security Setting - Block Javascript or VBScript Policy
Description: This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet.
Why It's Important: Attackers often use JavaScript or VBScript files as a first step to launch malware that’s been downloaded from the internet. These scripts can silently trigger harmful programs without the user knowing. This setting blocks scripts from launching downloaded executables, cutting off a common method used in phishing and drive-by attacks. SHIELD enables this policy to stop threats before they can run—like preventing a suspicious email attachment from opening a dangerous program behind the scenes.
Learn More
ESM Security Setting - Office Apps Executable Content Policy
Description: This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.
Why It's Important: Attackers often use Office apps like Word or Excel to create and drop malicious executable files onto a system. These files can then be used to install malware or gain unauthorized access. This setting blocks Office apps from writing executable content to disk, cutting off a common method used in document-based attacks. SHIELD enables this policy to prevent threats from turning trusted apps into launchpads for malware. It’s like stopping someone from using a company printer to produce fake IDs—keeping trusted tools from being misused.
Learn More
ESM Security Setting - Office Apps Code Injection Policy
Description: This rule blocks code injection attempts from Office apps into other processes.
Why It's Important: Attackers often use malicious Office documents to inject code into other programs running on your computer. This technique allows them to run malware silently, using trusted apps like Word or Excel as a disguise. This setting blocks Office apps from injecting code into other processes, cutting off a common method used in targeted attacks and malware campaigns. SHIELD enables this policy to stop threats from hijacking trusted applications. It’s like preventing someone from using your tools to break into another room—keeping control where it belongs.
Learn More
ESM Security Setting - Office Communication Child Processes Policy
Description: This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access.
Why It's Important: [Coming Soon]
Learn More
ESM Security Setting - WMI event persistence policy
Description: This rule prevents malware from abusing WMI to attain persistence on a device. Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden.
Why It's Important: Some types of malware use WMI (Windows Management Instrumentation) to stay hidden and automatically restart even after a reboot. This technique is often used in fileless attacks, which don’t leave obvious traces on the system. This setting helps detect that kind of behavior by logging when something tries to use WMI for persistence. SHIELD enables this rule in audit mode to monitor for suspicious activity without blocking legitimate tools. It’s like watching who tries to sneak in through a hidden service entrance—so you can decide later whether to lock it down.
Learn More
ESM Security Setting - PSExec and WMI commands Policy
Description: This rule blocks processes created through PsExec and WMI from running. Both PsExec and WMI can remotely execute code, so there is a risk of malware abusing this functionality for command and control purposes, or to spread an infection throughout an organization's network.
Why It's Important: Tools like PSExec and WMI are often used by IT teams for remote management, but attackers also use them to move across networks and run malicious commands without being noticed. This rule helps detect when those tools are used to launch processes, which could be a sign of lateral movement or a remote attack. SHIELD enables this rule in audit mode to monitor how these tools are used in your environment without blocking legitimate activity. It’s like watching who uses the service elevator before deciding whether to restrict access—giving you visibility without disruption.
Learn More
ESM Security Setting - Safe Mode Rebooting Policy
Description: This rule blocks attempts of restarting a machine in SAFE mode.
Why It's Important: Safe Mode is a special startup mode in Windows that disables most security tools, making it easier for attackers to tamper with or disable protections like antivirus software. Some malware tries to reboot a system into Safe Mode to avoid detection and carry out malicious actions. This setting blocks attempts to restart the machine in Safe Mode, helping prevent attackers from bypassing security controls. SHIELD enables this policy to protect systems even during startup—like stopping someone from sneaking in through a back entrance when the alarms are off.
Learn More
ESM Security Setting - Untrusted and Unsigned Processes from USB Policy
Description: With this rule, admins can prevent unsigned or untrusted scripts (such as VBScript, JavaScript) and executables (such as .exe, .dll, .scr files) from removable USB drives, including attached SD cards, from running.
Why It's Important: USB drives are a common way for malware to spread—especially when files on them are untrusted or unsigned. Attackers often use removable media to sneak malicious programs into a system, bypassing network defenses. This setting blocks those risky files from running unless they’re verified and trusted. SHIELD enables this policy to stop threats at one of the most vulnerable entry points. It’s like refusing to run unknown software from a flash drive unless it comes with proper ID—keeping systems safe from plug-and-play attacks.
Learn More
ESM Security Setting - Copied or Impersonated System Tools Policy
Description: This rule blocks executables that impersonate or are copies of system tools & binaries found on the machine.
Why It's Important: Attackers often try to hide their actions by using fake or copied versions of trusted system tools—like mimicking PowerShell or Task Manager—to run malicious commands without raising alarms. This setting blocks those impersonated tools from running, helping prevent attackers from blending in with legitimate system activity. SHIELD enables this policy to stop threats that try to disguise themselves as trusted software. It’s like spotting a fake badge at a security checkpoint—only real, verified tools are allowed to operate.
Learn More
ESM Security Setting - Webshell creation Policy
Description: This rule blocks webshell creation for servers.
Why It's Important: Webshells are malicious scripts that attackers place on servers to gain remote control, often without being detected. They’re a common tool used in targeted attacks and can lead to data theft, ransomware deployment, or full system compromise. This setting blocks the creation of webshells on servers, helping stop attackers from establishing a foothold. SHIELD enables this policy to protect critical infrastructure by cutting off one of the most dangerous and stealthy attack methods. It’s like preventing someone from secretly installing a backdoor into your server room—keeping control where it belongs
Learn More
ESM Security Setting - Block Win32 API Calls Policy
Description: This ASR rule detects when Office macros attempt to call Win32 APIs, which are low-level system functions often used by attackers to execute malicious code or bypass security controls. In Audit mode, the rule logs the activity without blocking it, allowing administrators to monitor potential threats and evaluate the impact of enforcing the rule.
Why It's Important: Macros in Office files can be used to run powerful system commands through Win32 API calls. While some advanced users or legacy tools might use this legitimately, attackers often abuse it to run malware. SHIELD sets this rule to audit mode to monitor how often this happens and where, without breaking legitimate workflows. It’s like watching who tries to access a restricted area before deciding whether to lock the door—giving you insight without disruption.
Learn More
ESM Security Setting - Controlled Folder Access Policy
Description: The previous name was EnableGuardMyFolders and changed to EnableControlledFolderAccess. This policy enables setting the state (On/Off/Audit) for the controlled folder access feature. The controlled folder access feature removes modify and delete permissions from untrusted applications to certain folders such as My Documents. Value type is integer and the range is 0 - 2.
Why It's Important: Controlled Folder Access helps protect important folders—like Documents and Pictures—from unauthorized changes by suspicious or untrusted apps. It’s especially useful against ransomware, which tries to encrypt or delete files. Setting this policy to audit mode allows Defender to log when an app tries to access protected folders without actually blocking it. SHIELD enables this mode to help security teams understand which apps might be affected before enforcing stricter protection. It’s like watching who tries to enter a secure area before deciding whether to lock the door—safe, cautious, and informative.
Learn More
ESM Security Setting - Protection Against Ransomware Policy
Description: This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or an exclusion list.
Why It's Important: Ransomware is one of the most damaging types of malware—it locks or encrypts your files and demands payment to get them back. This rule adds an extra layer of protection by scanning executable files to see if they behave like ransomware, even if they haven’t been seen before. Setting this rule to Audit allows security teams to monitor how often this behavior occurs without blocking anything yet. SHIELD enables this policy in audit mode to gather insights and prepare for full enforcement. It’s like testing a new alarm system by tracking how often it would go off—so you can fine-tune it before locking the doors.
Learn More
Privileged
PSM Security Setting - Abuse Of Exploited Vulnerable Signed Drivers (Device) Policy
Description: This rule prevents an application from writing a vulnerable signed driver to disk. In-the-wild, vulnerable signed drivers can be exploited by local applications - that have sufficient privileges - to gain access to the kernel. Vulnerable signed drivers enable attackers to disable or circumvent security solutions, eventually leading to system compromise. The Block abuse of exploited vulnerable signed drivers rule does not block a driver already existing on the system from being loaded.
Why It's Important: This policy blocks attempts to install vulnerable signed drivers, preventing attackers from exploiting them to bypass SHIELD protections and gain kernel-level access.
Learn More
PSM Security Setting - Adobe Reader Creating Child Processes
Description: This rule prevents attacks by blocking Adobe Reader from creating additional processes.
Why It's Important: This policy blocks Adobe Reader from creating child processes, preventing attackers from exploiting PDF files to launch malicious code and bypass SHIELD protections.
Learn More
PSM Security Setting - Block all Office applications from creating child processes Policy
Description: This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access.
Why It's Important: This policy blocks Office applications from creating child processes, preventing attackers from using Office documents to launch malicious code and bypass SHIELD protections.
Learn More
PSM Security Setting - Block credential stealing from the Windows LSASS Policy
Description: This rule helps prevent credential stealing, by locking down Local Security Authority Subsystem Service (LSASS).
Why It's Important: This policy blocks attempts to steal credentials from LSASS, protecting against common attacker techniques like Pass-the-Hash and helping SHIELD maintain account security.
Learn More
PSM Security Setting - Executable Content From Email Client And Webmail Policy
Description: This rule blocks the following file types from launching from email opened within the Microsoft Outlook application, or Outlook.com and other popular webmail providers: Executable files (such as .exe, .dll, or .scr), Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file).
Why It's Important: This policy blocks executable and script content from email clients and webmail, preventing attackers from delivering and launching malicious files through email.
Learn More
PSM Security Setting - Block executable Files From Running Policy
Description: This rule blocks the following file types from launching unless they meet prevalence or age criteria, or they're in a trusted list or an exclusion list: Executable files (such as .exe, .dll, or .scr).
Why It's Important: This policy blocks executables from running unless they meet reputation or trusted criteria, preventing attackers from launching unverified files and helping SHIELD enforce application control.
Learn More
PSM Security Setting - Execution of potentially obfuscated scripts
Description: This rule detects suspicious properties within an obfuscated script.
Why It's Important: This policy blocks execution of obfuscated scripts, preventing attackers from hiding malicious code in script files and helping SHIELD protect against script-based attacks.
Learn More
PSM Security Setting - Block JavaScript or VBScript from launching downloaded executable content Policy
Description: This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet.
Why It's Important: This policy blocks JavaScript and VBScript from launching downloaded executables, preventing attackers from using scripts to deliver and run additional malware.
Learn More
PSM Security Setting - Office applications Creating Executable Content Policy
Description: This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating potentially malicious executable content, by blocking malicious code from being written to disk.
Why It's Important: This policy blocks Office applications from creating executable content, preventing attackers from using Office files to drop or run malicious code.
Learn More
PSM Security Setting - Office Applications Injecting Code Into Other Processes Policy
Description: This rule blocks code injection attempts from Office apps into other processes.
Why It's Important: This policy blocks Office applications from injecting code into other processes, preventing attackers from abusing trusted apps to bypass SHIELD protections or escalate attacks.
Learn More
PSM Security Setting - Office Communication Application Creating Child Processes Policy
Description: This rule prevents Outlook from creating child processes, while still allowing legitimate Outlook functions.
Why It's Important: This policy blocks Outlook from creating child processes, preventing attackers from exploiting email-based attacks to launch malicious code and bypass SHIELD defenses.
Learn More
PSM Security Setting - Persistence Through WMI Event Subscription Policy
Description: This rule prevents malware from abusing WMI to attain persistence on a device. Fileless threats employ various tactics to stay hidden, to avoid being seen in the file system, and to gain periodic execution control. Some threats can abuse the WMI repository and event model to stay hidden.
Why It's Important: This policy blocks persistence through WMI event subscriptions, stopping attackers from using hidden, fileless techniques to evade SHIELD monitoring and maintain unauthorized access.
Learn More
PSM Security Setting - Process Creations From PSExec And WMI Commands Policy
Description: [Coming soon]
Why It's Important: [Coming soon]
Learn More
PSM Security Setting - Rebooting Machine In Safe Mode Policy
Description: This rule blocks attempts of restarting a machine in SAFE mode.
Why It's Important: This policy blocks attempts to restart a machine in Safe Mode, preventing attackers from bypassing security controls that may be disabled in that state.
Learn More
PSM Security Setting - Untrusted And Unsigned Processes That Run From USB
Description: With this rule, admins can prevent unsigned or untrusted scripts (such as VBScript, JavaScript) and executables (such as .exe, .dll, .scr files) from removable USB drives, including attached SD cards, from running.
Why It's Important: This policy blocks untrusted or unsigned processes from running off USB media, preventing attackers from using removable drives to bypass SHIELD controls and deliver malware.
Learn More
PSM Security Setting - Block use of copied or impersonated system tools
Description: This rule blocks executables that impersonate or are copies of system tools & binaries found on the machine.
Why It's Important: This policy blocks copied or impersonated system tools, preventing attackers from using fake or tampered binaries to evade SHIELD controls or perform malicious actions.
Learn More
PSM Security Setting - Block Webshell creation for Servers Policy
Description: This rule blocks webshell creation for servers.
Why It's Important: This policy blocks webshell creation on servers, preventing attackers from establishing hidden backdoors that could bypass SHIELD controls and enable persistent remote access.
Learn More
PSM Security Setting - Win32 API calls from Office macros Policy
Description: This rule prevents VBA macros from calling Win32 APIs.
Why It's Important: This policy blocks Office macros from calling Win32 APIs, preventing attackers from abusing macros to execute malicious code and bypass SHIELD endpoint defenses.
Learn More
PSM Security Setting - Controlled Folder Access Policy
Description: The previous name was EnableGuardMyFolders and changed to EnableControlledFolderAccess. This policy enables setting the state (On/Off/Audit) for the controlled folder access feature. The controlled folder access feature removes modify and delete permissions from untrusted applications to certain folders such as My Documents. Value type is integer and the range is 0 - 2.
Why It's Important: This policy enables audit mode for Controlled Folder Access, allowing visibility into potential unauthorized file access attempts without blocking, helping validate rules before enforcement.
Learn More
PSM Security Setting - Advanced Protection Against Ransomware Policy
Description: This rule provides an extra layer of protection against ransomware. It scans executable files entering the system to determine whether they're trustworthy. If the files closely resemble ransomware, this rule blocks them from running, unless they're in a trusted list or an exclusion list.
Why It's Important: This policy blocks untrusted executables that resemble ransomware, adding an extra layer of defense to prevent ransomware from running on devices.
Learn More