From da37fde3fa3283ae9340e4fbab2d2f8337f044f5 Mon Sep 17 00:00:00 2001 From: Malin De Silva Date: Sun, 14 Apr 2019 00:00:47 +0530 Subject: [PATCH] changed 1121 and 1122 to block and audit modes Confirmed with following article. https://www.ghacks.net/2017/10/23/configure-attack-surface-reduction-in-windows-10/ --- .../evaluate-attack-surface-reduction.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md index 307b13fd20..93e5640492 100644 --- a/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md +++ b/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-attack-surface-reduction.md @@ -53,8 +53,8 @@ To review apps that would have been blocked, open Event Viewer and filter for Ev | Event ID | Description | |----------|-------------| |5007 | Event when settings are changed | -| 1121 | Event when an attack surface reduction rule fires in audit mode | -| 1122 | Event when an attack surface reduction rule fires in block mode | +| 1121 | Event when an attack surface reduction rule fires in block mode | +| 1122 | Event when an attack surface reduction rule fires in audit mode | ## Customize attack surface reduction rules