Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Block executable content from email client and webmail

This `DWORD` value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule.

since 0.9.8.11

Purpose

Show registry keys (1)
  • HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\be9ba2d9-53ea-4cdc-84e5-9b1eeee46550

This DWORD value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A value of 1 places the rule in Block mode.

The rule blocks executable content propagated through email opened in Microsoft Outlook, Outlook.com, and other popular webmail providers. Covered content includes:

  • executable files such as .exe, .dll, and .scr;
  • script files such as .ps1, .vbs, and .js;
  • archive files such as .zip.

The GUID be9ba2d9-53ea-4cdc-84e5-9b1eeee46550 identifies this specific ASR rule.

Notes

Additional effects

Blocked activity can be recorded as ASR events and surfaced in Microsoft Defender for Endpoint under the AsrExecutableEmailContentBlocked action type. The rule also supports EDR alerts and local user notifications. Whether those alerts and notifications are generated depends on the Microsoft Defender Antivirus cloud protection level.

Security

The rule reduces exposure to malware delivered through executable email content, scripts, or archives. Blocking does not depend on the file already having been classified as malware.

Its protection is limited to the content and delivery paths covered by this rule. It does not automatically block other email threats or executable content obtained from unrelated sources.

Possible side effects

Legitimate executables, scripts, and archives delivered through email clients or webmail can also be blocked. This can disrupt workflows that use email to distribute software, support tools, or automation scripts.

Notes

The rule depends on Microsoft Defender Antivirus. Enforcement of ASR rules requires Microsoft Defender Antivirus to be enabled in Active mode with real-time protection turned on.

The rule is supported on Windows 10 version 1709 and later, Windows 11, and supported Windows Server releases. On Windows Server 2012 R2 and Windows Server 2016, support requires onboarding with the modern unified solution package.

Microsoft documentation

Microsoft Learn: Attack surface reduction (ASR) rules reference

Microsoft Learn: Attack surface reduction (ASR) rules overview

See also