Microsoft is enabling by default the Microsoft Defender 'Attack Surface Reduction' security rule to block attackers from stealing Windows credentials from the LSASS process.