deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 22:37:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Merged PR 4278: Merge wdav-asr-updates to master

Browse Source 
Update ASR to limit Office block rules to productivity apps only
This commit is contained in:
Iaan D'Souza-Wiltshire 2017-11-02 21:03:53 +00:00
commit 6a8325f394
1 changed files with 16 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
windows/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md
View File

@ -21,7 +21,12 @@ ms.date: 08/25/2017
**Applies to:** **Applies to:**
- Windows 10, version 1709 - Windows 10, version 1709 (and later)
- Microsoft Office 365
- Microsoft Office 2016
- Microsoft Office 2013
- Microsoft Office 2010
@ -47,7 +52,7 @@ The feature is comprised of a number of rules, each of which target specific beh
- Executable files and scripts used in Office apps or web mail that attempt to download or run files - Executable files and scripts used in Office apps or web mail that attempt to download or run files
- Scripts that are obfuscated or otherwise suspicious - Scripts that are obfuscated or otherwise suspicious
- Behaviors that apps undertake that are not usually inititated during normal day-to-day work - Behaviors that apps undertake that are not usually initiated during normal day-to-day work
See the [Attack surface reduction rules](#attack-surface-reduction-rules) section in this topic for more information on each rule. See the [Attack surface reduction rules](#attack-surface-reduction-rules) section in this topic for more information on each rule.
@ -69,6 +74,15 @@ Block JavaScript or VBScript from launching downloaded executable content | D3E0
Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
Block Win32 API calls from Office macro | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B Block Win32 API calls from Office macro | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
The rules apply to the following Office apps running on Windows 10, version 1709. See the **Applies to** section at the start of this topic for a list of supported Office version.
Supported Office apps:
- Microsoft Word
- Microsoft Excel
- Microsoft PowerPoint
- Microsoft OneNote
The rules do not apply to any other Office apps.
### Rule: Block executable content from email client and webmail ### Rule: Block executable content from email client and webmail