Merge pull request #3384 from YongRhee-MSFT/docs-editor/attack-surface-reduction-rules-1743814485

Update attack-surface-reduction-rules-reference.md

Author: Dansimp

defender-endpoint/attack-surface-reduction-rules-reference.md

@@ -250,6 +250,13 @@ For rules with the "Rule State" specified:
 
 ### Block abuse of exploited vulnerable signed drivers
 
+> [!NOTE]
+> To protect your environment from vulnerable drivers, you should first implement these:
+> For Windows 10 or later, Windows Server 2016 or later using [Microsoft App Control for Business](/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules), you should block all drivers by default and only allow drivers that you deem necessary and are not known to be vulnerable.
+> For Windows 8.1 or older, Windows Server 2012 R2 or older, using [Microsoft AppLocker](/windows/security/application-security/application-control/app-control-for-business/applocker/understanding-applocker-allow-and-deny-actions-on-rules), you should block all drivers by default and only allow drivers that you deem necessary and are not known to be vulnerable.
+> For Windows 11 or later, and Windows Server core 1809 or later, or Windows Server 2019 or later, you should also enable [Microsoft Windows vulnerable driver blocklist](/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules), 
+> Then as another layer of defense, you should enable this attack surface reduction rule.
+
 This rule prevents an application from writing a vulnerable signed driver to disk. In-the-wild, vulnerable signed drivers can be exploited by local applications \- _that have sufficient privileges_ \- to gain access to the kernel. Vulnerable signed drivers enable attackers to disable or circumvent security solutions, eventually leading to system compromise.
 
 The **Block abuse of exploited vulnerable signed drivers** rule doesn't block a driver already existing on the system from being loaded.