Windows Defender: Attack Surface Reduction - No Events in EventLog for some blocked actions

[Guest Steffen_Azure]

I have some ASR rules activated (set to Block) for my clients, like "Block process creations originating from PSExec and WMI commands" or "Block JavaScript or VBScript from launching downloaded executable content".While testing the rules it seems like, they work as intended but in the event viewer (as explained here) I only get an event (ID 1021) for some blocked ASR Rules . For examplem, the "Block JavaScript or VBScript from launching downloaded executable content". I used a simple script js to test it:var xmlHttp = WScript.CreateObject("MSXML2.XMLHTTP"); xmlHttp.open("GET", "https://w

 

Continue reading...