HK Productions

Issue with Attack Surface Reduction Rule "Block Win32 API calls from Office macros when set to warn mode.

youtube.com/shorts/bCDBAUtyoP...

Currently, the Attack Surface Reduction (ASR) rule "Block Win32 API calls from Office macros" is experiencing an issue. When the rule is configured and tested, a pop-up appears to unblock macros. However, even if "unblock" is clicked, the macros remain blocked due to a backend issue from Microsoft.

A fix for this issue will be deployed soon. In the meantime, we recommend adding ASR per rule exclusion to the path if you need to allow important applications and maintain product impact.

1 year ago (edited) | [YT] | 3