Block Office communication application from creating child processes
This registry value controls a Microsoft Defender Antivirus attack surface reduction (ASR) rule.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\26190899-1602-49e8-8b27-eb1d0a1ce869
This registry value controls a Microsoft Defender Antivirus attack surface reduction (ASR) rule. It is a DWORD value, and a value of 1 enables the rule in Block mode.
The rule prevents Outlook from creating child processes. Consequently, code initiated through Outlook cannot use Outlook as the parent process for launching script interpreters, command-line tools, or other executables. The restriction applies to process creation; Outlook itself remains available, and the rule is designed to preserve legitimate Outlook functionality.
Notes
Security
The rule reduces the risk of malicious code being launched from Outlook through social engineering, crafted content, or exploitation of Outlook vulnerabilities. It also protects against techniques that abuse Outlook rules or forms to start additional processes after an attacker has compromised a user's credentials.
Its protection is limited to process creation by the affected Office communication application. It is not a general application-control mechanism, does not inspect every item processed by Outlook, and does not replace malware protection or other ASR rules. In particular, it is distinct from the separate rule that blocks child-process creation by all supported Office applications.
Possible side effects
Outlook add-ins, custom forms, or line-of-business workflows can be affected if they depend on Outlook launching an external program as a child process. This rule has limited support for exclusions.
Notes
The rule depends on Microsoft Defender Antivirus. For ASR rules to operate, Microsoft Defender Antivirus and its real-time protection must be active.
Microsoft documents this rule for Windows 10 version 1709 and later, Windows 11, and supported Windows Server versions. Support on Windows Server 2012 R2 and Windows Server 2016 requires the modern unified Microsoft Defender for Endpoint solution package.
The rule is enforced only when Office is installed under %ProgramFiles% or %ProgramFiles(x86)%. Because the registry value is stored under HKLM, it has device scope.
Microsoft documentation
Microsoft Learn: Attack surface reduction rules reference
Microsoft Learn: Attack surface reduction rules overview