Skip to content

Commit d99c828

Browse files
Update attack-surface-reduction-rules-reference.md
Changing per recommendation.
1 parent cb3de30 commit d99c828

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

defender-endpoint/attack-surface-reduction-rules-reference.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -584,7 +584,7 @@ Dependencies: Microsoft Defender Antivirus
584584
### Block rebooting machine in Safe Mode
585585

586586
> [!NOTE]
587-
> This feature isn't yet supported in Threat and Vulnerability Management, so the Attack Surface Reduction rule report will show as "Not applicable" for Windows and Windows Servers.
587+
> This feature isn't supported in Threat and Vulnerability Management, so the Attack Surface Reduction rule report will show as "Not applicable" for Windows and Windows Servers.
588588
589589
This rule prevents the execution of commands to restart machines in Safe Mode. Safe Mode is a diagnostic mode that only loads the essential files and drivers needed for Windows to run. However, in Safe Mode, many security products are either disabled or operate in a limited capacity, which allows attackers to further launch tampering commands, or execute and encrypt all files on the machine. This rule blocks such attacks by preventing processes from restarting machines in Safe Mode.
590590

@@ -625,7 +625,7 @@ Dependencies: Microsoft Defender Antivirus
625625
### Block use of copied or impersonated system tools
626626

627627
> [!NOTE]
628-
> This feature isn't yet supported in Threat and Vulnerability Management, so the Attack Surface Reduction rule report will show as "Not applicable" for Windows and Windows Servers.
628+
> This feature isn't supported in Threat and Vulnerability Management, so the Attack Surface Reduction rule report will show as "Not applicable" for Windows and Windows Servers.
629629
630630
This rule blocks the use of executable files that are identified as copies of Windows system tools. These files are either duplicates or impostors of the original system tools. Some malicious programs might try to copy or impersonate Windows system tools to avoid detection or gain privileges. Allowing such executable files can lead to potential attacks. This rule prevents propagation and execution of such duplicates and impostors of the system tools on Windows machines.
631631

@@ -658,7 +658,7 @@ GUID: `a8f5898e-1dc8-49a9-9878-85004b8a61e6`
658658
Dependencies: Microsoft Defender Antivirus
659659

660660
> [!NOTE]
661-
> When managing ASR rules using Microsoft Defender for Endpoint security settings management, the setting for **Block Webshell creation for Servers** must be configured as `Not Configured` in Group Policy or other local settings. If this rule is set to any other value (such as `Enabled` or `Disabled`), it could cause conflicts and prevent the policy from applying correctly through security settings management. This feature isn't yet supported in Threat and Vulnerability Management, so the Attack Surface Reduction rule report will show as "Not applicable" for Exchange servers.
661+
> When managing ASR rules using Microsoft Defender for Endpoint security settings management, the setting for **Block Webshell creation for Servers** must be configured as `Not Configured` in Group Policy or other local settings. If this rule is set to any other value (such as `Enabled` or `Disabled`), it could cause conflicts and prevent the policy from applying correctly through security settings management. This feature isn't supported in Threat and Vulnerability Management, so the Attack Surface Reduction rule report will show as "Not applicable" for Exchange servers.
662662
663663
### Block Win32 API calls from Office macros
664664

0 commit comments

Comments
 (0)