Questions about Defender ASR rules

Topic

New Reply

[technic]

Block executable files from running unless they meet a prevalence, age, or trusted list criterion

Does the above rule include (native) scripts (bat,ps1,vbs,js)?

Does it work the same way as Smartscreen but even for files without the Mark-of-the-Web? How is it different than Smartscreen?

How is it different than ISG in WDAC?

 

Block JavaScript or VBScript from launching downloaded executable content

Does it include Powershell and batch scripts? Why not?

• This topic was modified 3 weeks, 1 day ago by technic.

Reply | Quote

Replies

See Use attack surface reduction rules to prevent malware infection | Microsoft Learn for Microsoft’s explanation. Of course, being Microsoft you’ll have more questions after reading the article(s).

Here’s a blog post that may help too – Demystifying attack surface reduction rules – Part 1 – Microsoft Community Hub. It is the first in a series.

 

--Joe

1 user thanked author for this post.

technic

Reply | Quote

Thanks, but I’m asking here because the info on Microsoft’s site is vague.

1 user thanked author for this post.

wavy

Reply | Quote