Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 945704" data-attributes="member: 32260">Microsoft disabled its own PowerShell cmdlets for managing ASR rules (Disabled, AuditMode) when Tamper Protection is enabled. When the user opens PowerShell console and tries to set any ASR rule to Disabled or Audit Mode, then Defender blocks the cmdlet and Logs the event as :Trojan:Win32/MpTamperASRRule.PSA&nbsp; (for AuditMode attempt)Trojan:Win32/MpTamperASRRule.PSD (for disabling attempt)This does not affect the PowerShell cmdlets when the user wants to enable ASR rules.For now, these changes do not affect the functionality of &lt;DEFAULT&gt;, &lt;HIGH&gt;, &lt;INTERACTIVE&gt;, &lt;MAX&gt; options in ConfigureDefender. They work as usual. Anyway, when the user wants to set a particular ASR rule manually to Disabled or Audit, Defender will block the attempt with an alert. It is still possible to do it when Tamper Protection is temporarily disabled.I will try to negotiate with Microsoft to whitelist ConfigureDefender in Tamper Protection, but the chances for that are not great.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />Furthermore, I think that Microsoft is doing the right thing, except labeling the action as Trojan.</blockquote>

[QUOTE="Andy Ful, post: 945704, member: 32260"] Microsoft disabled its own PowerShell cmdlets for managing ASR rules (Disabled, AuditMode) when Tamper Protection is enabled. When the user opens PowerShell console and tries to set any ASR rule to [COLOR=rgb(184, 49, 47)][B]Disabled or Audit[/B][/COLOR] Mode, then Defender blocks the cmdlet and Logs the event as : [COLOR=rgb(41, 105, 176)][B]Trojan:Win32/MpTamperASRRule.PSA[/B][/COLOR] (for AuditMode attempt) [B][COLOR=rgb(41, 105, 176)]Trojan:Win32/MpTamperASRRule.PSD[/COLOR][/B] (for disabling attempt) [B]This does not affect the PowerShell cmdlets when the user wants to enable ASR rules.[/B] For now, these changes do not affect the functionality of <DEFAULT>, <HIGH>, <INTERACTIVE>, <MAX> options in ConfigureDefender. They work as usual. Anyway, when the user wants to set a particular ASR rule manually to Disabled or Audit, Defender will block the attempt with an alert. It is still possible to do it when Tamper Protection is temporarily disabled. I will try to negotiate with Microsoft to whitelist ConfigureDefender in Tamper Protection, but the chances for that are not great.:( Furthermore, I think that Microsoft is doing the right thing, except labeling the action as Trojan. [/QUOTE]

Verification