Attack Surface Reduction Rule Discovery

An operator or adversary may inspect the locally reported Microsoft Defender Attack Surface Reduction (ASR) rule IDs and actions to learn which protections are configured. This is security-control discovery under ATT&CK T1518.001; querying settings does not itself trigger an ASR rule or prove that every reported rule is effectively enforced.