This is great, but I just dont understand why ASR detects files that ATP itself is loading. I have the following messages in my timeline:
Microsoft.AppV.AppvClientComConsumer.ni.dll was blocked by ASR using rule "loading non-Microsoft signed binary"
Microsoft.PowerShell.Commands.Management.ni.dll was blocked by ASR using rule "loading non-Microsoft signed binary"
System.Management.Automation.ni.dll was blocked by ASR using rule "loading non-Microsoft signed binary"
Which all are loaded by ..\Windows Defender Advanced Threat Protection\SenseIR.exe
I'm not sure if this is Insider Build Related but I am perplexed either way why a security product is using unsigned DLLs . I guess i need to exclude SenseIR.exe from the ASR rules? Or am I missing something? Thanks in advance to anyone with some insight.