%3CLINGO-SUB%20id%3D%22lingo-sub-159809%22%20slang%3D%22en-US%22%3EStopping%20attacks%20that%20use%20SLK%20files%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-159809%22%20slang%3D%22en-US%22%3E%3CP%3ENew%20attacks%20that%20hide%20behind%20SLK%20or%20symbolic%20link%20files%20to%20launch%20malicious%20content%20from%20Excel%20are%20handily%20caught%20by%20Windows%20Defender%20ATP%20as%20malicious%20behavior.%20Yes%2C%20we%20flag%20bad%20behaviors%2C%20.slk%20or%20otherwise.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-left%22%20style%3D%22width%3A%20896px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F28787i1D8DB864FA5A6D01%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22slk.png%22%20title%3D%22slk.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20block%20attacks%20that%20use%20SLK%20with%20DDE%2C%20%3CA%20href%3D%22https%3A%2F%2Ftechnet.microsoft.com%2Fen-us%2Flibrary%2Fsecurity%2F4053440%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3Edisable%20DDE%3C%2FA%3E%20and%20turn%20on%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fwindows%2Fsecurity%2Fthreat-protection%2Fwindows-defender-exploit-guard%2Fattack-surface-reduction-exploit-guard%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%20noopener%20noreferrer%22%3EAttack%20surface%20reduction%20in%20Windows%20Defender%20Exploit%20Guard%3C%2FA%3E.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

New attacks that hide behind SLK or symbolic link files to launch malicious content from Excel are handily caught by Windows Defender ATP as malicious behavior. Yes, we flag bad behaviors, .slk or otherwise.

 

slk.png

 

To block attacks that use SLK with DDE, disable DDE and turn on Attack surface reduction in Windows Defender Exploit Guard.