Blog Post

Microsoft Defender for Endpoint Blog

4 MIN READ

Recovering from Attack Surface Reduction rule shortcut deletions

Scott Woodgate

Microsoft

Jan 14, 2023

Updated 1/23/2023 @ 1:10pm PST

On January 13th, Windows Security and Microsoft Defender for Endpoint customers may have experienced a series of false positive detections for the Attack Surface Reduction (ASR) rule "Block Win32 API calls from Office macro" after updating to security intelligence builds between 1.381.2134.0 and 1.381.2163.0. These detections resulted in the deletion of files that matched the incorrect detection logic primarily impacting Windows shortcut (.lnk) files.

There is no impact for customers who do not have the “Block Win32 API calls from Office macro” rule turned on in block mode or did not update to security intelligence update builds 1.381.2134.0, 1.381.2140.0, 1.381.2152 and 1.381.2163.0.

For currently impacted customers: what do I need to do?

Impacted customers will need both the updated security intelligence build and follow the process to recover start menu and taskbar shortcuts.

The updated security intelligence build

Customers should update to build 1.381.2164.0 or later. Customers utilizing automatic updates for Microsoft Defender antivirus do not need to take additional action to receive the updated security intelligence build. Enterprise customers managing updates should download the latest update and deploy it across their environments. The security intelligence build does not restore deleted shortcuts. Instructions on how to restore those are immediately below. If you turned “Block Win32 calls from Office macros” into audit mode per prior guidance you can now safely turn on block mode.

To recover deleted start menu and taskbar shortcuts

Microsoft has confirmed steps that customers can take to recreate start menu links for a significant sub-set of the affected applications that were deleted.

Version 5.0 provides improved error handling for AddShortcuts.ps1 to ensure RunOnce executes when a logged off user logs back in. MpRecoverTaskbar.exe now supports restoring each user’s Chrome and Edge pinned taskbar shortcuts found per profile. For more details click here.

1/ Download both AddShortcuts.ps1 and MpRecoverTaskBar.exe and select from the following options:

Option A/ If you are using System Center Config Manager or Group Policy Object Editor or third-party tools then deploy both files and run the command “powershell -ep bypass -file .\AddShortcuts.ps1 -MpTaskBarRecoverUtilDownload=false” as Administrator.

Option B/ If you are using Intune or no management tool then deploy AddShortcuts.ps1 and run the command “powershell -ep bypass -file .\AddShortcuts.ps1” as Administrator. This will automatically download MPTaskBarRecover.exe from the Microsoft download center onto the user’s machine and run the script. Detailed instructions on how to deploy the script using Microsoft Intune are here.

2/ The changes will come into effect after users logout and login to their accounts.

3/ The MPRecoverTaskbar.exe can be run multiple times on end-user machines if necessary. If end-users are missing taskbar icons after completing this process, then try running it a second time from %windir%\MPRecoverTaskbar.exe in the user context.

The script requires PowerShell 5.x and does not currently support PowerShell 7.x.

Version 5.0 includes all the improvements from Version 4.0: restores from Volume Shadow Copy Service by default, recovers .URL files in the user's profile's Favorites and Desktop directories, if those URL files exist in the Volume Shadow Copy Service, contains improvements for non-English language machines, improved error handling and additional checks that help recover more shortcuts and links, better error handling to perform all the actions including running the MpRecoverTaskbar.exe, while adding support for better error handling using AddShortcuts.ps1 to ensure RunOnce executes when a logged off user logs back in, and enabling MPRecoverTaskbar.exe to restore each user’s Chrome and Edge pinned taskbar shortcuts found per profile.

To add programs to the script: edit the $program variable and add a new line with the name of the application lnk and the executable.

For customers that prefer manual steps rather than the script running an application repair on affected applications will recreate deleted links. Users can run the Application Repair functionality for programs including Microsoft 365, Microsoft Edge, and Microsoft Visual Studio.

To repair an application, follow these instructions:

Windows 10:

Select Start > Settings > Apps > Apps & features
Select the app you want to fix.
Select Modify link under the name of the app if it is available.
A new page will launch and allow you to select repair.

Windows 11:

Type “Installed Apps” in the search bar.
Click “Installed Apps”.
Select the app you want to fix.
Click on “…”
Select Modify or Advanced Options if it is available.
A new page will launch and allow you to select repair.

Verifying environment impact

Customers can verify the impact of this issue in their environment through the following advanced hunting queries (AHQs):

This AHQ can retrieve all block events from devices with ASR rule "Block Win32 API calls from Office macro" enabled on “Block” mode, run this query.

DeviceEvents

| where Timestamp >= datetime(2023-01-13)

| where ActionType contains "AsrOfficeMacroWin32ApiCallsBlocked"

| extend JSON = parse_json(AdditionalFields)

| extend isAudit = tostring(JSON.IsAudit)

| where isAudit == "false"

| summarize by Timestamp, DeviceName, DeviceId, FileName, FolderPath, ActionType, AdditionalFields

| sort by Timestamp asc

This AHQ can retrieve all events from devices with ASR rule "Block Win32 API calls from Office macro" enabled on “block” and “audit” mode, run this query.

DeviceEvents

| where Timestamp >= datetime(2023-01-13)

| where ActionType contains "AsrOfficeMacroWin32ApiCallsBlocked"

| summarize by Timestamp, DeviceName, DeviceId, FileName, FolderPath, ActionType, AdditionalFields

| sort by Timestamp asc

This AHQ can retrieve the device count with this ASR rule “Block Win32 API calls from Office macro” enabled and if the number is exceeding 10K, run this query.

DeviceEvents

| where Timestamp >= datetime(2023-01-13)

| where ActionType contains "AsrOfficeMacroWin32ApiCallsBlocked"

| summarize deviceCount = dcount(DeviceId)

| extend IsMoreThanTenThousand = iif(deviceCount> 10000, True, False)

Advanced Hunting Queries are not available in Defender for Endpoint P1 which is also included in E3 and A3 or in Defender for Business. To identify affected machines run the script here on individual user machines.

FAQ

Additional questions are addressed in the FAQ document.

Updated Jan 23, 2023

Version 28.0

Scott Woodgate

Microsoft

Joined September 07, 2016

View Profile

Microsoft Defender for Endpoint Blog

Microsoft Defender for Endpoint disrupts ransomware with industry-leading endpoint security, providing comprehensive protection across all platforms and devices.

When evaluating various solutions, your peers value hearing from people like you who’ve used the product. Review Defender for Endpoint by filling out a Gartner Peer Insights survey and receive a $25 USD gift card (for customers only). Here are the Privacy/Guideline links: Microsoft Privacy Statement, Gartner’s Community Guidelines & Gartner Peer Insights Review Guide.

154 Comments

Eggtastico
Copper Contributor
Jan 20, 2023
EvanMcNally That is because you right clicked the link & saved as. So you have saved the whole webpage & not the script. You need to follow the link first in the article & then copy the script out from that webpage. Script is about 57k
David_Swenson
Steel Contributor
Jan 20, 2023
Scott Woodgate , Appreciate all the diligence your team has shown by releasing these scripts and such but I am left wondering why a company like Microsoft cannot just reverse all this BS they caused OR provide a simple Intune Compatible app upload (win32) that would function as a proactive remediation (since Microsoft doesn't allow Proactive remediation functionality for Microsoft 365 Business Premium which is just really dumb)? Can you give us something actually useful for the average MSP to deploy to their Intune managed customers (especially seeing as how there is NO central way **cough invest more in Microsoft 365 Lighthouse** to centrally deploy these fixes to the hundreds of customers we have under management? Have some sympathy and leverage the rest of Microsoft resources across the 365 management stack to get this DONE!
Sujit-MSFT
Microsoft
Jan 19, 2023
JasonBeckett , EvanMcNally - Please download the ps1 script from https://github.com/microsoft/MDE-PowerBI-Templates/blob/master/ASR_scripts/AddShortcuts.ps1 , and then deploy it using Intune or your management solution (it is less than 200KB in size). The "ampersand (&) character is not allowed." error might be ocurring because you are downloading an .html file, not the actual .ps1 file.
Jason Beckett
Copper Contributor
Jan 19, 2023
Getting the following error when running:
204 char:17
+ Sign up
+ ~
The ampersand (&) character is not allowed. The & operator is reserved for future use; wrap an ampersand in double
quotation marks ("&") to pass it as part of a string.
EvanMcNally
Copper Contributor
Jan 19, 2023
Microsoft: Are you aware this script is too large to run as a script in Intune? 200k size limit pf powershell scripts.

Consequently, your link to Intune script instructions is incorrect and not usable.

Please provide a correct set of instructions, including the steps to convert the script to a Win32 intune app to work around the abusurd 200k limit.

Then go talk to the people who created this 200k limit on scripts and make them change their poor decision.

We will be using a different RMM tool which is able to execute large powershgell scripts, unlike Intune. We will likely also be switching to an antivirus product which has a quarantine feature--omg, what a concept.

Microsoft: even your fixes for the problems you create are a day late and a dollar short. Sheesh. Intune instructions which won't actually work. Really?

Thank you.

Edit to add screenshot:
Cynamin
Copper Contributor
Jan 19, 2023
akakillroy - I have an open SR with Microsfot. They told me as long as the machines in your environment have security intelligence builds later than 1.381.2163.0, it is safe to proceed with "testing" setting the affected ASR Rule to Blocked mode.
Simonzee81
Copper Contributor
Jan 19, 2023
All,

I have found that the fastest way for me to do this (as just a handfull of people are affected), is to download the mediacreationtool and make a ISO of windows and store it on your c:\ drive.
From there run the iso and after that run the setup and just do a "in place" upgrade and choose to keep all files and apps.
It litterally took me about 15/20 minutes to restore everything to how it was with all the links etc!
akakillroy
Copper Contributor
Jan 19, 2023
At what point can we re-enable the ASR rule?
akakillroy
Copper Contributor
Jan 19, 2023
Lots of great input here, we took the provided script and application (Found that by default the script will download the task bar repair app" and deployed it with our RMM solution Itarian, now Xcitium through a Procedure, and we can deploy on demand, likewise if you have Intune you can easily deploy that way, I also found that we had to use the -force switch as even though most machines were impacted on the date/time specified some machines were not having shortcuts replaced.
All of our systems with the exception of a small group have the exact same setup for applications and start menu items. We are considering collecting on a regular basis the existing start menu via a weekly capture on departmental machines so if something like this happens again, we can more easily deploy a new start menu. Also, this tool would be a valuable asset to have in the event it is needed again.

For the love of GOD Microsoft don't let it happen again!
yoyojammer
Copper Contributor
Jan 19, 2023
So the biggest fallout for us was the Start Menu Icons.... I've managed to get this fixed by deploying a startmenulayout.xml that uses the link path instead of the application ID's, Microsoft's fix restores links but not with the original ID's as previous comments so we went back to basics using a link path and it's fixed for our users. In the future if there is upgrades to the software and paths change we will need to update but for now it's good enough and should be until we migrate to Windows 11.

Hope this helps someone in the same situation 🙂

<LayoutModificationTemplate
xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout"
xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout"
xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1"
xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification">
<LayoutOptions StartTileGroupCellWidth="6" />
<DefaultLayoutOverride LayoutCustomizationRestrictionType="OnlySpecifiedGroups">
<StartLayoutCollection>
<defaultlayout:StartLayout GroupCellWidth="6">
<start:Group Name="Applications">
<start:DesktopApplicationTile Size="2x2" Column="2" Row="2" DesktopApplicationLinkPath="%programfiles%\Microsoft Office\root\Office16\POWERPNT.EXE" />
<start:DesktopApplicationTile Size="2x2" Column="2" Row="4" DesktopApplicationLinkPath="%programfiles%\Google\Chrome\Application\chrome.exe" />
<start:Tile Size="2x2" Column="0" Row="4" AppUserModelID="Microsoft.CompanyPortal_8wekyb3d8bbwe!App" />
<start:DesktopApplicationTile Size="2x2" Column="0" Row="6" DesktopApplicationLinkPath="%Windir%\Explorer.exe" />
<start:DesktopApplicationTile Size="2x2" Column="0" Row="2" DesktopApplicationLinkPath="%programfiles%\Microsoft Office\root\Office16\OUTLOOK.EXE" />
<start:DesktopApplicationTile Size="2x2" Column="4" Row="4" DesktopApplicationID="Microsoft.SkyDrive.Desktop" />
<start:DesktopApplicationTile Size="2x2" Column="4" Row="2" DesktopApplicationID="MSEdge" />
<start:DesktopApplicationTile Size="2x2" Column="0" Row="0" DesktopApplicationID="com.squirrel.Teams.Teams" />
<start:DesktopApplicationTile Size="2x2" Column="2" Row="0" DesktopApplicationLinkPath="%programfiles%\Microsoft Office\root\Office16\WINWORD.EXE" />
<start:DesktopApplicationTile Size="2x2" Column="4" Row="0" DesktopApplicationLinkPath="%programfiles%\Microsoft Office\root\Office16\EXCEL.EXE" />
</start:Group>
</defaultlayout:StartLayout>
</StartLayoutCollection>
</DefaultLayoutOverride>
<CustomTaskbarLayoutCollection PinListPlacement="Replace">
<defaultlayout:TaskbarLayout>
<taskbar:TaskbarPinList>
<taskbar:UWA AppUserModelID="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge" />
<taskbar:DesktopApp DesktopApplicationLinkPath="%APPDATA%\Microsoft\Windows\Start Menu\Programs\System Tools\File Explorer.lnk" />
</taskbar:TaskbarPinList>
</defaultlayout:TaskbarLayout>
</CustomTaskbarLayoutCollection>
</LayoutModificationTemplate>