In my previous blog, I talked about how you can leverage Windows Defender ATP’s Advanced hunting to monitor Attack Surface Reduction (ASR) alerts in audit mode and dig a little deeper into the potent...
Updated Aug 14, 2018
Version 2.0
Blog Post
It looks like even using PROCESS_QUERY_LIMITED_INFORMATION (probably the least dangerous, most limited query) triggers this ASR rule 😞
Guys, go and fix this problem.