Merged PR 4278: Merge wdav-asr-updates to master

Update ASR to limit Office block rules to productivity apps only
This commit is contained in:
Iaan D'Souza-Wiltshire 2017-11-02 21:03:53 +00:00
commit 6a8325f394

View File

@ -21,7 +21,12 @@ ms.date: 08/25/2017
**Applies to:**
- Windows 10, version 1709
- Windows 10, version 1709 (and later)
- Microsoft Office 365
- Microsoft Office 2016
- Microsoft Office 2013
- Microsoft Office 2010
@ -47,7 +52,7 @@ The feature is comprised of a number of rules, each of which target specific beh
- Executable files and scripts used in Office apps or web mail that attempt to download or run files
- Scripts that are obfuscated or otherwise suspicious
- Behaviors that apps undertake that are not usually inititated during normal day-to-day work
- Behaviors that apps undertake that are not usually initiated during normal day-to-day work
See the [Attack surface reduction rules](#attack-surface-reduction-rules) section in this topic for more information on each rule.
@ -69,6 +74,15 @@ Block JavaScript or VBScript from launching downloaded executable content | D3E0
Block execution of potentially obfuscated scripts | 5BEB7EFE-FD9A-4556-801D-275E5FFC04CC
Block Win32 API calls from Office macro | 92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B
The rules apply to the following Office apps running on Windows 10, version 1709. See the **Applies to** section at the start of this topic for a list of supported Office version.
Supported Office apps:
- Microsoft Word
- Microsoft Excel
- Microsoft PowerPoint
- Microsoft OneNote
The rules do not apply to any other Office apps.
### Rule: Block executable content from email client and webmail