Hello again and welcome to the second part in our blog series on demystifying attack surface reduction (ASR) rules. This blog post is focused on how to configure Microsoft Defender ATP ASR rules and ...
Updated May 05, 2020
Version 8.0
Blog Post
Hi
Did this change? #7 ASR rules run under NT AUTHORITY\SYSTEM account, so environmental variables are limited to machine variables.
Since 7-27-2022
I have been seeing around 40 of 1800 machines in my work environment that are showing blocks under %userprofile% or usercontext for .dll blocks. This is new behavior and is recent.
ASR Rule/Example Path - that is having this issue
Block executable content from email client and webmail
GUID: be9ba2d9-53ea-4cdc-84e5-9b1eeee46550
Path: %userprofile%\AppData\Local\Assembly\tmp\*variousfilesandpaths*.dll
Did this behavior change, is this a preview of a new feature or is this a bug?