We want to block Office macro attacks and ransomware chains

Attack Surface Reduction rules in Defender block typical exploit paths: Office spawning cmd.exe, scripts from temp folders. Audit first, then block.

Try this first

1. 1Defender > Endpoints > ASR > set rules to audit
2. 2Collect for a week, identify false positives
3. 3Block mode for the safe set: 7 rules with low impact
4. 4Exceptions by path, not by executable

None of the above fits?

Describe your situation below. We pass your input plus the steps you already saw to our AI and return tailored next-step advice. If it's too risky to DIY, we'll say so.