mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 04:13:41 +00:00
Add reviewer changes.
This commit is contained in:
@ -123,12 +123,10 @@ This rule blocks the following file types from being run or launched from an ema
|
||||
|
||||
### Rule: Block Office applications from creating child processes
|
||||
|
||||
Office apps, such as Word or Excel, will not be allowed to create child processes.
|
||||
Office apps will not be allowed to create child processes. This includes Word, Excel, PowerPoint, OneNote, Outlook, and Access.
|
||||
|
||||
This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables.
|
||||
|
||||
In Windows 10, version 1803 and later, this rule also blocks suspicious apps from being launched through Outlook or Access.
|
||||
|
||||
### Rule: Block Office applications from creating executable content
|
||||
|
||||
This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique.
|
||||
|
Reference in New Issue
Block a user