Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 988836" data-attributes="member: 32260">The XLSX documents cannot contain macros but have got other dangerous features (like DDE, etc.). If you use Defender with ASR rules then the XLSX extension can be safely removed via &lt;Settings&gt;&lt;Protected SRP Extensions&gt;. If you use the DocumentsAntiExploit tool, then the XLSX extension can be safely removed when using any AV.The problem can arise if one uses custom settings to harden MS Office manually. Home users are focused on Word hardening and often forget to properly harden Excel. It is not easy to make Excel hardening because it has got many dangerous features.The Excel files are rarely used at home and commonly used in attacks, so they are blocked in SWH ver. 1.1.1.1 by default. I am not sure if this is an optimal solution. What do you think guys?</blockquote>

[QUOTE="Andy Ful, post: 988836, member: 32260"] [B]The XLSX documents cannot contain macros but have got other dangerous features (like DDE, etc.). I[B]f you use [COLOR=rgb(0, 168, 133)]Defender with ASR rules [/COLOR]then [/B]the XLSX extension can be safely removed via <Settings><Protected SRP Extensions>. If you use the [COLOR=rgb(0, 168, 133)]DocumentsAntiExploit tool[/COLOR], then the XLSX extension can be safely removed when using any AV.[/B] The problem can arise if one uses custom settings to harden MS Office manually. Home users are focused on Word hardening and often forget to properly harden Excel. It is not easy to make Excel hardening because it has got many dangerous features. The Excel files are rarely used at home and commonly used in attacks, so they are blocked in SWH ver. 1.1.1.1 by default. I am not sure if this is an optimal solution. What do you think guys? [/QUOTE]

Verification