#attack-surface-reduction 1 post tagged attack-surface-reduction. Attack Surface Reduction Rules: The Quiet Layer That Stopped Office Macros May 25, 2026 How Microsoft built a 19-rule, kernel-mediated behaviour block list inside Windows Defender that turned the Emotet macro chain into a one-row, no-ticket telemetry event.