Block Office applications from creating executable content
This registry value controls the corresponding attack surface reduction (ASR) rule in Microsoft Defender Antivirus.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\3b576869-a4ec-4529-8536-b80a7769e899
This registry value controls the corresponding attack surface reduction (ASR) rule in Microsoft Defender Antivirus. A DWORD value of 1 enables the rule in Block mode.
The rule prevents Office applications such as Word, Excel, and PowerPoint from placing executable content on disk and making it available as a potential attack component. In particular, Microsoft Defender can block access to or execution of code written to disk by an Office application. It can also block untrusted executable files saved by Office macros that are otherwise permitted to run.
The rule does not generally prevent Office applications from saving ordinary documents. It is also distinct from the separate ASR rule that prevents Office applications from creating child processes.
Notes
Security
This rule reduces the opportunity for a malicious Office document or macro to deposit executable malware on a device. It specifically disrupts a persistence technique in which written components remain available after a restart and continue operating on the system.
Protection is limited to activity detected within the scope of this ASR rule. It does not replace Office file scanning or other controls for macros, malware, and untrusted applications.
Possible side effects
Legitimate Office-dependent workflows can be disrupted if they generate executable content, access such content, or launch executable files saved by macros. Microsoft Defender can block the affected file access or execution.
Notes
The rule depends on Microsoft Defender Antivirus and RPC. ASR rules require Microsoft Defender Antivirus to be active, with real-time protection enabled. This particular rule is enforced regardless of the Office installation location.
File-based exclusions have limited support for this rule.
Microsoft documentation
Microsoft Learn: Attack surface reduction (ASR) rules reference
Microsoft Learn: Policy CSP – Defender