Attack surface reduction rules
Observed content change
1 removed passage (8 words). The changed wording mentions network endpoints. Review the source to confirm the effect.
May need admin actionCheck your firewall and proxy allow lists.
[removed: Applies to: Microsoft Defender for Endpoint Plan 2]
Short quotes of Microsoft's changed wording from Microsoft source, © Microsoft Corporation. Read the page for the full text.
Read the current Microsoft source · Link to this observation · Compare any two versions
Sections to inspect
- Attack surface reduction (ASR) rules reference
Up to 12 section headings from retained before/after evidence. The current source may have changed again.
Why this was flagged
The changed words, with a few words around them, matched these rule categories: network endpoints. These matches identify subjects to assess; they do not establish a policy change or applicability.
Observation details · observed 12 Oct 23:53 UTC
- Observed by ChangeIntel
- 12 Oct 23:53 UTC
- Source update metadata
- 11 Sep 07:34 UTC
- First observed on this installation
- 8 Oct 23:13 UTC
- Last successful check
- today 00:34 UTC
- Next check due
- 27 Oct 00:34 UTC
Observation time is not publication time, and a comparison does not establish an effective date. Full source bodies are not published; this page holds generated summaries, section headings and, as the page's license allows, Microsoft's changed wording. A documentation edit does not confirm feature availability in an environment.
This is an earlier observation; review the latest in My radar.
Timeline
From the capture of 12 Oct 23:53 UTC · an earlier observation- 15 undated sections
- 30 with conditions
Settings and overrides named on this page
Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.
AsrUntrustedExecutableAuditedAsrUntrustedExecutableBlockedCredential Guard
Requirements, exceptions and scope
- Block credential stealing from the Windows local security authority subsystemRequirementExceptionRecommendation2 conditions3 passages
Credential Guard - Block executable files from running unless they meet a prevalence, age, or trusted list criterionRequirementException15 conditions12 passages
AsrUntrustedExecutableAuditedAsrUntrustedExecutableBlocked - Block JavaScript or VBScript from launching downloaded executable contentException2 conditions2 passages
- Block Office applications from injecting code into other processesRequirementExceptionScope2 conditions3 passages
Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.
Observed history and review priority
Captured 12 Oct 23:53 UTC; extracted 22 Oct 18:57 UTC. Extractor: microsoft-1/9/d9863eb412f92fa5ec3a8ca32e2dd7cfe8095530f456ecb1866608d1166a435d.
Earlier unavailable versions and edits between checks are unknown. A missing statement requires review; it does not mean the policy was cancelled. Recovered historical statements are not original revision snapshots.
Retained observations · 3
Compact evidence remains available after full document bodies expire. Earlier extractions can have different vocabulary or capture limitations.
- 24 Oct 00:24 UTC · 39 candidates
- 12 Oct 23:53 UTC · 39 candidates
- 8 Oct 23:13 UTC · 31 candidates
Retained observations
- 24 Oct 00:24 UTC
Source metadata changed; retained article content is unchanged.
- 12 Oct 23:53 UTC · shown above
- 8 Oct 23:13 UTC
Baseline for retained history; no earlier retained text to compare.
What changed
First observed 18 Oct 2026No field changes are shown for this selection.
Cite this recorded revision to keep the same title, summary, facts and links when the page changes.
A day selects the latest observation by the end of that UTC day; today's selection can change until midnight. History starts when this installation records it.