Block all Office applications from creating child processes
This registry value controls the Microsoft Defender attack surface reduction rule identified by `d4f940ab-401b-4efc-aadc-ad5f3c50688a`.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\d4f940ab-401b-4efc-aadc-ad5f3c50688a
This registry value controls the Microsoft Defender attack surface reduction rule identified by d4f940ab-401b-4efc-aadc-ad5f3c50688a. It is a DWORD value, and value data 1 places this individual rule in Block mode.
In Block mode, Microsoft Defender Antivirus prevents covered Office applications from creating child processes. Those applications therefore cannot launch other programs as new processes. Microsoft identifies Word, Excel, PowerPoint, OneNote, and Access as Office applications covered by this rule.
The value has device-wide scope and controls only this ASR rule. It does not automatically enable or configure other attack surface reduction rules.
Notes
Security
The rule disrupts a commonly abused attack chain in which a malicious macro or exploit running through an Office application launches additional programs or payloads. It can, for example, block a covered Office application from starting Command Prompt, PowerShell, or another executable component.
Its protection is limited to child-process creation. The rule does not generally disable macros, prevent every form of code execution within Office, or replace separate rules that address executable-content creation and other Office-based attack techniques.
Possible side effects
Legitimate Office-based line-of-business applications and document workflows can also depend on child processes. Features that invoke Command Prompt, PowerShell, or another external program might fail or lose functionality. When enforcing the process-creation restriction, the rule does not distinguish between a malicious purpose and an intended business operation.
Notes
The rule depends on Microsoft Defender Antivirus. ASR rules require Microsoft Defender Antivirus to be active as the primary antivirus application with real-time protection enabled.
The rule is enforced only when Office is installed under %ProgramFiles% or %ProgramFiles(x86)%. Microsoft lists it as supported on Windows 10 version 1709 and later, Windows 11, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019 or later.
Microsoft documentation
Microsoft Learn: Attack surface reduction rules reference
Microsoft Learn: Attack surface reduction rules overview