Incorp tech review

windows/security/threat-protection/windows-defender-exploit-guard/attack-surface-reduction-exploit-guard.md

@@ -23,20 +23,16 @@ Attack surface reduction rules help prevent behaviors malware often uses to infe
 
 To use attack surface reduction rules, you need a Windows 10 Enterprise E3 license or higher. A Windows E5 license gives you the advanced management capabilities to power them. These include monitoring, analytics, and workflows available in [Windows Defender Advanced Threat Protection](../windows-defender-atp/windows-defender-advanced-threat-protection.md), as well as reporting and configuration capabilities in the M365 Security Center. These advanced capabilities aren't available with an E3 license, but you can use attack surface reduction rule events in Event Viewer to help facilitate deployment.
 
-Attack surface reduction rules target specific behaviors that malware and malicious apps typically use to infect computers, including:
+Attack surface reduction rules target behaviors that malware and malicious apps typically use to infect computers, including:
 
 - Executable files and scripts used in Office apps or web mail that attempt to download or run files
 - Obfuscated or otherwise suspicious scripts
 - Behaviors that apps don't usually initiate during normal day-to-day work
 
-Because legitimate, line-of-business applications might also use some of these behaviors and apps, you can [exclude them from attack surface reduction rules](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#exclude-files-and-folders-from-asr-rules).
-
-You can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks similar to malware. By monitoring audit data and adding exclusions for necessary applications, you can deploy attack surface reduction rules without impacting productivity.
+You can use [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how attack surface reduction rules would impact your organization if they were enabled. It's best to run all rules in audit mode first so you can understand their impact on your line-of-business applications. Many line-of-business applications are written with limited security concerns, and they may perform tasks similar to malware. By monitoring audit data and [adding exclusions](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#exclude-files-and-folders-from-asr-rules) for necessary applications, you can deploy attack surface reduction rules without impacting productivity.
 
 Triggered rules display a notification on the device. You can [customize the notification](customize-attack-surface-reduction.md#customize-the-notification) with your company details and contact information. The notification also displays in the Windows Defender ATP Security Center and on the M365 console. 
 
-You can set attack surface reduction rules in [audit mode](audit-windows-defender-exploit-guard.md) to evaluate how they'd impact your organization once enabled.
-
 For information about configuring attack surface reduction rules, see [Enable attack surface reduction rules](enable-attack-surface-reduction.md).
 
 ## Attack surface reduction rules
@@ -60,16 +56,7 @@ Block untrusted and unsigned processes that run from USB | b2b3f03d-6a65-4f7b-a9
 Block Office communication application from creating child processes | 26190899-1602-49e8-8b27-eb1d0a1ce869
 Block Adobe Reader from creating child processes | 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c
 
-Each rule description indicates which apps or file types the rule applies to. In general, the rules for Office apps apply to only Word, Excel, PowerPoint, and OneNote, or they apply to Outlook. They don't apply to any other Office apps like Flow or Teams.
-
-In general, attack surface reduction rules apply to the following Office apps:
-
-- Microsoft Word
-- Microsoft Excel
-- Microsoft PowerPoint
-- Microsoft OneNote
-
-Except where specified, attack surface reduction rules don't apply to any other Office apps.
+Each rule description indicates which apps or file types the rule applies to. In general, the rules for Office apps apply to only Word, Excel, PowerPoint, and OneNote, or they apply to Outlook. Except where specified, attack surface reduction rules don't apply to any other Office apps.
 
 ### Block executable content from email client and webmail
 
@@ -88,7 +75,7 @@ GUID: BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550
 
 This rule blocks Office apps from creating child processes. This includes Word, Excel, PowerPoint, OneNote, and Access.
 
-This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables. Some legitimate line-of-business applications might also use behaviors like this, including spawning a command prompt or using PowerShell to configure registry settings.
+This is a typical malware behavior, especially malware that abuses Office as a vector, using VBA macros and exploit code to download and attempt to run additional payload. Some legitimate line-of-business applications might also use behaviors like this, including spawning a command prompt or using PowerShell to configure registry settings.
 
 Intune name: Office apps launching child processes
 
@@ -100,9 +87,7 @@ GUID: D4F940AB-401B-4EFC-AADC-AD5F3C50688A
 
 This rule prevents Office apps, including Word, Excel, and PowerPoint, from creating executable content. 
 
-This rule targets typical behaviors used by suspicious and malicious add-ons and scripts (extensions) that create or launch executable files. This is a typical malware technique, which often embeds an encoded binary file within the script that is then dropped and executed.
-
-Office apps won't be able to use extensions. Typically, these extensions use the Windows Scripting Host (.wsh files) to run scripts that automate certain tasks or provide user-created add-on features.
+This rule targets a typical behavior where malware uses Office as a vector to break out of Office and save malicious components to disk, where they persist and survive a computer reboot. This rule prevents malicious code from being written to disk.
 
 Intune name: Office apps/macros creating executable content
 
@@ -126,7 +111,7 @@ GUID: 75668C1F-73B5-4CF0-BB93-3ECF5CB7CC84
 
 Malware often uses JavaScript and VBScript scripts to launch other malicious apps. 
 
-This rule prevents scripts from launching apps, helping to prevent malicious use of the scripts to spread malware and infect machines. This isn't a common line-of-business use, but line-of-business applications sometimes use scripts to download and launch installers.
+Malware written in JavaScript or VBS often acts as a downloader to fetch and launch additional native payload from the Internet. This rule prevents scripts from launching downloaded content, helping to prevent malicious use of the scripts to spread malware and infect machines. This isn't a common line-of-business use, but line-of-business applications sometimes use scripts to download and launch installers. You can exclude scripts so they're allowed to run.
 
 >[!IMPORTANT]
 >File and folder exclusions don't apply to this attack surface reduction rule.
@@ -141,8 +126,6 @@ GUID: D3E037E1-3EB8-44C8-A917-57927947596D
 
 Script obfuscation is a common technique that both malware authors and legitimate applications use to hide intellectual property or decrease script loading times. This rule detects suspicious properties within an obfuscated script.
 
-This rule blocks scripts from running downloaded content, preventing malicious use of the scripts to spread malware and infect computers. You can exclude scripts so they're allowed to run.
-
 Intune name: Obfuscated js/vbs/ps/macro code
 
 SCCM name: Block execution of potentially obfuscated scripts.
@@ -231,14 +214,14 @@ GUID: b2b3f03d-6a65-4f7b-a9c7-1c7ef74a9ba4
 
 ### Block Office communication application from creating child processes
 
-This rule prevents Outlook from creating child processes. It prevents apps from launching when a user double-clicks an attachment or clicks a link embedded in an email. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised.
+This rule prevents Outlook from creating child processes. It protects against social engineering attacks and prevents exploit code from abusing a vulnerability in Outlook. To achieve this, the rule prevents the launch of additional payload while still allowing legitimate Outlook functions. It also protects against [Outlook rules and forms exploits](https://blogs.technet.microsoft.com/office365security/defending-against-rules-and-forms-injection/) that attackers can use when a user's credentials are compromised.
 
 >[!NOTE]
 >This rule applies to Outlook and Outlook.com only.
 
-Intune name: Not applicable
+Intune name: Not yet available
 
-SCCM name: Not applicable
+SCCM name: Not yet available
 
 GUID: 26190899-1602-49e8-8b27-eb1d0a1ce869