Block JavaScript or VBScript from launching downloaded executable content
This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\d3e037e1-3eb8-44c8-a917-57927947596d
This registry value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A DWORD value of 1 enables the rule in Block mode.
The rule prevents JavaScript- or VBScript-based scripts from launching downloaded executable content. It disrupts a common malware execution chain in which a script acts as a downloader, retrieves additional malware from the internet, and then launches it.
This rule is not a general download restriction. It does not block every script or every method of running downloaded files; it applies when the rule detects JavaScript or VBScript launching downloaded executable content.
Notes
Security
The block reduces exposure to attacks that use script files as downloaders or as an intermediate stage for executing additional malware. It does not necessarily prevent the content from being downloaded; its primary protection is against the subsequent launch initiated by the script.
The rule does not replace general application control and does not prevent downloaded content from being started through execution paths outside its scope.
Possible side effects
Line-of-business applications, deployment systems, or installers can be affected if they use JavaScript or VBScript to download and immediately launch executable installation or update files. Such installation or update workflows can fail when the downloaded file is launched.
Notes
The rule depends on Microsoft Defender Antivirus and the Antimalware Scan Interface (AMSI). ASR rules also require Microsoft Defender Antivirus to be the primary antivirus application, running in active mode with real-time protection enabled.
The rule is supported on Windows 10, version 1709, and later. Some centrally managed features and older Windows Server versions have additional product and deployment limitations.
Microsoft documentation
Microsoft Learn: ASR rules reference
Microsoft Learn: Defender Policy CSP – AttackSurfaceReductionRules