Attack surface reduction rule triggers a mess on Friday the 13

Topic

New Reply

#Fridaythethirteenthmess Microsoft 365 Status on Twitter: “The revert is in progress and may take several hours to complete. We recommend placing the
[See the full post at: Attack surface reduction rule triggers a mess on Friday the 13]

Susan Bradley Patch Lady/Prudent patcher

2 users thanked author for this post.

bobolink, lmacri

Reply | Quote

Replies

Hi Susan:

Thanks for the heads up.

Is it safe to assume that home users with a Win 10/Win 11 Pro OS who used their Local Group Policy Editor (gpedit.msc) to “Block Office applications from creating child processes” (GUID Value: D4F940AB-401B-4EFC-AADC-AD5F3C50688A) as instructed in your post <here> in the AskWoody Plus Newsletter Issue 18.39 • 2021-10-11 are not affected by this problem?

You post today suggests that the only rule added to Computer Configuration | Administrative Templates | Windows Components | Microsoft Defender Antivirus | Microsoft Defender Exploit Guard | Attack Surface Reduction that can cause shortcuts to disappear is “Block Win32 API calls from Office macros” (GUID Value: 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b).
————–
Dell Inspiron 5584 * 64-bit Win 10 Pro v22H2 build 19045.2486 * Firefox v108.0.2 * Microsoft Defender v4.18.2211.5-1.1.19900.2 * Malwarebytes Premium v4.5.20.230-1.0.1868 * Macrium Reflect Free v8.0.7279

1 user thanked author for this post.

bobolink

Reply | Quote

Correct it’s only the one rule – Office macros – that will trigger the issue.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

lmacri

Reply | Quote

Win 10 Pro 22H2 19045.2364

I had the problem with shortcuts and programs disappearing with Security intellingence for Microsoft Defender  version 1.381.2140.0.

Restored my C drive Image using Image for Windows.

MS has released a new Microsoft Defender 1.381.2152.0.

I am using Configure Defender. Changed Block Win 32 API calls from Office Macros to Audit.

Now all is good.
B

 

Reply | Quote

It’s worth knowing that any Orgs that have deployed MS Security Baselines will have ASR configured (by default).

I’ve just spent the day clearing up this mess.  Thanks Microsoft…

Reply | Quote

Am I as a home W10 user affected by this? Is there something I need to do?

Reply | Quote

Unless you’ve specifically selected that ASR rule to block Office macros, otherwise, no.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Thank you again!

Reply | Quote

Microsoft : This issue is resolved in security intelligence update build 1.381.2164.0. Installing security intelligence update build 1.381.2164.0 or later should prevent the issue, but it will not restore previously deleted shortcuts. You will need to recreate or restore these shortcuts through other methods.

https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes?requestVersion=1.381.2164.0

Version: 1.381.2181.0

https://www.neowin.net/news/microsoft-says-it-cant-restore-defender-deleted-shortcuts-on-windows-11-and-10-for-you/

Reply | Quote

From aka.ms/asrfprecovery:

To recover deleted Windows shortcut lnks

Microsoft has confirmed steps that customers can take to recreate start menu links for a significant sub-set of the affected applications that were deleted. These have been consolidated into the PowerShell script below to help enterprise administrators take recovery actions in their environment.

The first version of the script is available here: MDE-PowerBI-Templates/AddShortcutsV1.ps1 at master · microsoft/MDE-PowerBI-Templates · GitHub

Microsoft will continue to enhance this script.

For customers that prefer manual steps rather than the script running an application repair on affected applications will recreate deleted links. Users can run the Application Repair functionality for programs including Microsoft 365, Microsoft Edge, and Microsoft Visual Studio.

To repair an application, follow these instructions:

Windows 10:
Select Start > Settings > Apps > Apps & features
Select the app you want to fix.
Select Modify link under the name of the app if it is available.
A new page will launch and allow you to select repair.

Windows 11:
Type “Installed Apps” in the search bar.
Click “Installed Apps”.
Select the app you want to fix.
Click on “…”
Select Modify or Advanced Options if it is available.
A new page will launch and allow you to select repair.

Verifying environment impact [Business Admins]

Customers can verify the impact of this issue in their environment through the following advanced hunting queries (AHQs):

This AHQ can retrieve all devices with ASR rule “Block Win32 API calls from Office macro” enabled on “Block” mode:

https://security.microsoft.com/v2/advanced-hunting?query=H4sIAAAAAAAAA32S3U7CQBCFz7WJ79B4BQkaEW8xqaI&#8230;

Quick Repair restored missing Office shortcuts to my Start menu. The longer Online Repair should be unnecessary.

1 user thanked author for this post.

Alex5723

Reply | Quote