ASR Rules - Outlook Spawning Child Process

[DannyC_Gamma]

We have an internal Telephony application that uses a "non-standard" communication protocol (BTBC). When a meeting request is sent via email, it presents a link that is prefixed by BTBC:// which then spawns the telephony app.
We have had to register the BTBC protocol as trusted so as not to run into an Outlook Security Warning but the ASR rule 26190899-1602-49e8-8b27-eb1d0a1ce869 blocks the spawning of the process
Is it possible to exclude only the telephony from being prevented from being spawned or would the exclusion need to apply to the Outlook process?

Thanks

[#2]

@Amitai Rottem is this something you can help with please?

[#3]

A related question - we're licensed for O365 E3 but have taken 50 licences (so far) of Windows Defender ATP (I think by uplifting 50 licenses for Windows 10 E3>E5) - how can I access support for WDATP?

If I try to access support via https://securitycenter.microsoft.com I'm getting an error message about not having a valid Azure subscription?

I've reached out to our Microsoft Account Team but had no response as yet

[#4]

Here's where you will find a good start

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-atp/windows-def...

also check out the tutorial page in the product for some cool DIYs

https://securitycenter.windows.com/tutorials

[#5]

@DannyC_Gamma Maybe this has already been resolved, but the exclusions should target the file that would be the child process started by Outlook, in the case of your situation. The docs linked weren't very clear on that before, and we were a bit confused by the language, so we tested it ourselves.  I think the docs may have been updated a little since then.

It does explain that exclusions apply across all rules, however - so you can't exclude a file only for a specific rule.  I'm not sure there is a scenario where a file would really need one ASR blocked activity but not another.

Exclusion info here:

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/e...

[#6]

@Chris Boggs - appreciate the reply and also appreciate that my question wasn't worded particularly eloquently 🙂

To be honest, I guess I kind of the knew the answer to the question but just needed confirmation for the business more than anything

[#7]

Ah, sorry, didn't mean to imply you worded your question poorly - I meant to say we had the same question when we were needing to make our first exclusion and couldn't find a definite answer in the docs - so we tested it ourselves.

[#8]

@Chris Boggs - Oh, I see! Well, I still believe I could have worded the question better 🙂

Good to have my findings verified, thanks for posting.