Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 799940" data-attributes="member: 32260">The ASR rules are grouped in ConfigureDefender just like in the official MS documents.There is an advantage of keeping the original grouping, because the newly introduced rules are at the end of the list, so they are easy to find and configure. The users usually do not touch the already configured rules.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />Furthermore, MS sometimes changes the rule names, so the original grouping can help the user to identify the ConfigureDefender rule name with the name actually preferred by MS.Edit.The proper regrouping of ASR rule names, would require some deeper knowledge about the connections between those rules. For example, the rule &quot;Block Adobe Reader from creating child processes&quot; is closely connected to the Office rules (PDFs can often have embedded Office weaponized documents&quot;) and to Script rules (Adobe exploit can use Script Interpreters).The rule &quot;Use advanced protection against ransomware&quot; is closely connected to anti-script protection (especially for PowerShell scripts). So, the proper grouping of rules is not easy, and if I would do it right, then the grouping would not be understood by most users, anyway.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite111" alt=":(" title="Frown&nbsp; &nbsp; :(" loading="lazy" data-shortname=":(" />The truth is also that, those rules are constantly updated and poorly documented. So, the actual protection granted by &quot;Use advanced protection against ransomware&quot; may differ from its protection in the next year.I think that I will pass for now, to regroup the rule names in ConfigureDefender.:notworthy:</blockquote>

[QUOTE="Andy Ful, post: 799940, member: 32260"] The ASR rules are grouped in ConfigureDefender just like in the official MS documents. There is an advantage of keeping the original grouping, because the newly introduced rules are at the end of the list, so they are easy to find and configure. The users usually do not touch the already configured rules.:giggle:(y) Furthermore, MS sometimes changes the rule names, so the original grouping can help the user to identify the ConfigureDefender rule name with the name actually preferred by MS. Edit. The proper regrouping of ASR rule names, would require some deeper knowledge about the connections between those rules. For example, the rule "Block Adobe Reader from creating child processes" is closely connected to the Office rules (PDFs can often have embedded Office weaponized documents") and to Script rules (Adobe exploit can use Script Interpreters). The rule "Use advanced protection against ransomware" is closely connected to anti-script protection (especially for PowerShell scripts). So, the proper grouping of rules is not easy, and if I would do it right, then the grouping would not be understood by most users, anyway.:( The truth is also that, those rules are constantly updated and poorly documented. So, the actual protection granted by "Use advanced protection against ransomware" may differ from its protection in the next year. I think that I will pass for now, to regroup the rule names in ConfigureDefender.:notworthy: [/QUOTE]

Verification