Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 955412" data-attributes="member: 32260">Yes. It is impossible to find some information about MoUsoCoreWorker blocks. Microsoft simply does not know how to help users or does not care about them. If one would like to ask for help about CFA or ASR on the answers.microsoft.com website, then I can say that the advisors know very little about these advanced settings. One of the advisors even thought that applying Defender&#039;s settings via PowerShell is a kind of hacking.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />Except for the MT forum, any useful practical information about ASR rules can be found only in a few articles, for example:[URL unfurl=&quot;true&quot;]https://medium.com/palantir/microsoft-defender-attack-surface-reduction-recommendations-a5c7d41c3cf8[/URL]I did not found any useful practical article about CFA problems. One can find more practical tips on this thread (or some other MT threads) than after spending many hours with Google. Even several Microsoft documents wrongly describe the events related to CFA (Id=1127 is often skipped).</blockquote>

[QUOTE="Andy Ful, post: 955412, member: 32260"] Yes. It is impossible to find some information about MoUsoCoreWorker blocks. Microsoft simply does not know how to help users or does not care about them. If one would like to ask for help about CFA or ASR on the answers.microsoft.com website, then I can say that the advisors know very little about these advanced settings. One of the advisors even thought that applying Defender's settings via PowerShell is a kind of hacking.:( Except for the MT forum, any useful practical information about ASR rules can be found only in a few articles, for example: [URL unfurl="true"]https://medium.com/palantir/microsoft-defender-attack-surface-reduction-recommendations-a5c7d41c3cf8[/URL] I did not found any useful practical article about CFA problems. One can find more practical tips on this thread (or some other MT threads) than after spending many hours with Google. Even several Microsoft documents wrongly describe the events related to CFA (Id=1127 is often skipped). [/QUOTE]

Verification