{
  "_comment": "Defender for Endpoint Attack Surface Reduction (ASR) rules. Intune の Endpoint security > Attack surface reduction で配布。POST /deviceManagement/configurationPolicies",
  "name": "Defender-ASR-Baseline-2026Q2",
  "description": "Office マクロ / 認証情報盗難 / Web 経由実行など、よくある攻撃面を縮小する ASR ルール 8 本",
  "platforms": "windows10",
  "technologies": "mdm",
  "settings": [
    {
      "_ruleName": "Block all Office applications from creating child processes",
      "_ruleId": "d4f940ab-401b-4efc-aadc-ad5f3c50688a",
      "_action": "Block",
      "_note": "Office マクロからの child process 実行をブロック。最も効果的な ASR ルールの 1 つ。"
    },
    {
      "_ruleName": "Block Office applications from creating executable content",
      "_ruleId": "3b576869-a4ec-4529-8536-b80a7769e899",
      "_action": "Block",
      "_note": "Office から .exe / .dll を書き出すパターンをブロック"
    },
    {
      "_ruleName": "Block execution of potentially obfuscated scripts",
      "_ruleId": "5beb7efe-fd9a-4556-801d-275e5ffc04cc",
      "_action": "AuditMode",
      "_note": "誤検知の可能性があるため、初回は AuditMode で 2 週間運用し、誤検知パターンを除外してから Block に移行"
    },
    {
      "_ruleName": "Block JavaScript or VBScript from launching downloaded executable content",
      "_ruleId": "d3e037e1-3eb8-44c8-a917-57927947596d",
      "_action": "Block"
    },
    {
      "_ruleName": "Block credential stealing from the Windows local security authority subsystem (lsass.exe)",
      "_ruleId": "9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2",
      "_action": "Block",
      "_note": "Mimikatz 系の攻撃に有効"
    },
    {
      "_ruleName": "Block process creations originating from PSExec and WMI commands",
      "_ruleId": "d1e49aac-8f56-4280-b9ba-993a6d77406c",
      "_action": "AuditMode",
      "_note": "リモート管理ツールに影響するため、Audit で運用棚卸ししてから Block 化"
    },
    {
      "_ruleName": "Block executable content from email client and webmail",
      "_ruleId": "be9ba2d9-53ea-4cdc-84e5-9b1eeee46550",
      "_action": "Block"
    },
    {
      "_ruleName": "Use advanced protection against ransomware",
      "_ruleId": "c1db55ab-c21a-4637-bb3f-a12568109d35",
      "_action": "Block"
    }
  ],
  "_assignmentExample": {
    "assignments": [
      {
        "target": {
          "@odata.type": "#microsoft.graph.groupAssignmentTarget",
          "groupId": "<ring-test-group-id>"
        }
      }
    ]
  },
  "_operationalNotes": [
    "ASR は誤検知が発生しやすいため、新規ルール導入は必ず AuditMode から開始",
    "AuditMode で 2 週間運用し、Defender ATP のイベントログから誤検知パターンを除外設定",
    "除外設定は端末固有ではなくパス / プロセス / ハッシュ単位で",
    "ルール変更前後で Sign-in / Defender ログを比較し、影響範囲を Postmortem 形式で記録"
  ]
}