ASR Rules - Outlook Spawning Child Process

Question

We have an internal Telephony application that uses a "non-standard" communication protocol (BTBC). When a meeting request is sent via email, it presents a link that is prefixed by BTBC:// which then spawns the telephony app.
We have had to register the BTBC protocol as trusted so as not to run into an Outlook Security Warning but the ASR rule 26190899-1602-49e8-8b27-eb1d0a1ce869 blocks the spawning of the process
Is it possible to exclude only the telephony from being prevented from being spawned or would the exclusion need to apply to the Outlook process?

Thanks

raviv tamir · Answer

Here's where you will find a good start
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection
&nbsp;
also check out the tutorial page in the product for some cool DIYs
https://securitycenter.windows.com/tutorials

heikeritter · Answer

Amitai Rottem is this something you can help with please?

dannyc_gamma · Answer

A related question - we're licensed for O365 E3 but have taken 50 licences (so far) of Windows Defender ATP (I think by uplifting 50 licenses for Windows 10 E3>E5) - how can I access support for WDATP?

If I try to access support via https://securitycenter.microsoft.com I'm getting an error message about not having a valid Azure subscription?

I've reached out to our Microsoft Account Team but had no response as yet

chris boggs · Answer

DannyC_Gamma&nbsp;Maybe this has already been resolved, but the exclusions should target the file that would be the child process started by Outlook, in the case of your situation. The docs linked weren't very clear on that before, and we were a bit confused by the language, so we tested it ourselves.&nbsp; I think the docs may have been updated a little since then.It does explain that exclusions apply across all rules, however - so you can't exclude a file only for a specific rule.&nbsp; I'm not sure there is a scenario where a file would really need one ASR blocked activity but not another.&nbsp;Exclusion info here:https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-attack-surface-reduction#exclude-files-and-folders-from-asr-rules&nbsp;

dannyc_gamma · Answer

Chris Boggs&nbsp;- appreciate the reply and also appreciate that my question wasn't worded particularly eloquently :)&nbsp;To be honest, I guess I kind of the knew the answer to the question but just needed confirmation for the business more than anything

Forum Discussion

ASR Rules - Outlook Spawning Child Process

7 Replies

Resources