Use advanced protection against ransomware
This `DWORD` value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\c1db55ab-c21a-4637-bb3f-a12568109d35
This DWORD value controls the corresponding Microsoft Defender Antivirus attack surface reduction (ASR) rule. A value of 1 places the rule in block mode.
The rule combines client-side and cloud-based heuristics to identify files that exhibit ransomware-like characteristics. Its scope is not limited to files with a known bad reputation: it can also block previously unknown files that have not yet established a positive reputation.
The rule does not block a file when Microsoft cloud intelligence considers it harmless, when the file has a valid signature, or when it is sufficiently prevalent not to be treated as ransomware.
Notes
Security
The rule adds a layer of ransomware protection by preventing suspicious or insufficiently trusted files from running. Because its decisions are heuristic, it is an additional safeguard rather than a guarantee that every ransomware variant will be blocked.
This registry value enables only the specified ASR rule. It does not enable other ASR rules or Controlled folder access.
Possible side effects
Legitimate files that are new or uncommon can be blocked while they lack sufficient reputation. A block can later cease as the file accumulates trust and reputation through nonmalicious use.
Exclusion support for this rule is limited. Compatibility issues involving uncommon or internally developed software can therefore be harder to accommodate than with ASR rules that provide full exclusion support.
Notes
The rule depends on Microsoft Defender Antivirus and cloud-delivered protection. It cannot provide its intended protection unless cloud-delivered protection is enabled.
Microsoft lists support for this rule on Windows 10 version 1803 and later, Windows 11, and supported Windows Server releases. Deployment through Microsoft Intune using the modern unified solution is not supported on Windows Server 2012 R2 or Windows Server 2016.
Microsoft documentation
Microsoft Learn: Attack surface reduction (ASR) rules reference
Microsoft Learn: Configure attack surface reduction (ASR) rules and exclusions