Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 692318" data-attributes="member: 32260">Here is the link to docs.microsoft.com article:<a href="https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard" target="_blank">Use Attack surface reduction rules to prevent malware infection</a>It follows from it, that ASR applies to:<ul>
<li data-xf-list-type="ul">Windows 10, version 1709 (and later)</li>
<li data-xf-list-type="ul">Microsoft Office 365</li>
<li data-xf-list-type="ul">Microsoft Office 2016</li>
<li data-xf-list-type="ul">Microsoft Office 2013</li>
<li data-xf-list-type="ul">Microsoft Office 2010</li>
</ul>The bad thing is that also the ASR rule &#039;Impede JavaScript and VBScript to launch executables&#039; seems not working outside Microsoft Office.After setting the ASR rules:[CODE]Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550,D4F940AB-401B-4EFC-AADC-AD5F3C50688A,3B576869-A4EC-4529-8536-B80A7769E899,75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84,D3E037E1-3EB8-44C8-A917-57927947596D,5BEB7EFE-FD9A-4556-801D-275E5FFC04CC,92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled,Enabled,Enabled,Enabled,Enabled[/CODE]I can still run successfully eso.exe via the simple RunEso.vbs script:[CODE]Set WshShell = CreateObject(&quot;WScript.Shell&quot;)WshShell.Run(&quot;c:\z\eso.exe&quot;)WScript.Quit[/CODE]</blockquote>

[QUOTE="Andy Ful, post: 692318, member: 32260"] Here is the link to docs.microsoft.com article: [URL='https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard']Use Attack surface reduction rules to prevent malware infection[/URL] It follows from it, that ASR applies to: [LIST] [*]Windows 10, version 1709 (and later) [*]Microsoft Office 365 [*]Microsoft Office 2016 [*]Microsoft Office 2013 [*]Microsoft Office 2010 [/LIST] The bad thing is that also the ASR rule 'Impede JavaScript and VBScript to launch executables' seems not working outside Microsoft Office. After setting the ASR rules: [CODE]Set-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550,D4F940AB-401B-4EFC-AADC-AD5F3C50688A,3B576869-A4EC-4529-8536-B80A7769E899,75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84,D3E037E1-3EB8-44C8-A917-57927947596D,5BEB7EFE-FD9A-4556-801D-275E5FFC04CC,92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B -AttackSurfaceReductionRules_Actions Enabled,Enabled,Enabled,Enabled,Enabled,Enabled,Enabled[/CODE] I can still run successfully eso.exe via the simple RunEso.vbs script: [CODE]Set WshShell = CreateObject("WScript.Shell") WshShell.Run("c:\z\eso.exe") WScript.Quit[/CODE] [/QUOTE]

Verification