Block Office applications from injecting code into other processes
This registry value controls the attack surface reduction rule identified by `75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84`.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84
This registry value controls the attack surface reduction rule identified by 75668c1f-73b5-4cf0-bb93-3ecf5cb7cc84. It is a DWORD value, and a value of 1 places the rule in Block mode.
The rule prevents Word, Excel, OneNote, and PowerPoint from attempting to inject code into other processes. Attackers can use process injection to execute malicious code within the context of another process, making the code appear to originate from a benign process.
Notes
Security
Blocking this behavior helps disrupt attacks in which a malicious document, macro, or exploited Office vulnerability injects code into another process. It can prevent malicious code from concealing its association with the originating Office application.
The rule is limited to this process-injection behavior. It does not generally disable macros or prevent Office applications from creating child processes or executable files. Separate ASR rules cover those behaviors.
Possible side effects
Microsoft documents this rule as incompatible with BeyondTrust Privilege Guard and Heimdal Security. Features of those products might therefore be affected when the rule operates in Block mode.
Microsoft reports no known legitimate business purpose for the Office code-injection behavior covered by this rule. However, the rule provides limited exclusion support, which can make an unexpected application conflict more difficult to accommodate.
Notes
The rule depends on Microsoft Defender Antivirus. It is enforced only when Office is installed under %ProgramFiles% or %ProgramFiles(x86)%. Affected Microsoft 365 or Office applications must be restarted after the rule state changes before the new state takes effect.
This rule does not support Warn mode. It is supported on Windows 10 version 1709 and later, Windows 11, and the Windows Server versions listed in the Microsoft reference. Windows Server 2012 R2 and Windows Server 2016 are subject to the documented modern unified solution requirements.
Microsoft documentation
Microsoft Learn: Attack surface reduction rules reference
Microsoft Learn: Defender Policy CSP — AttackSurfaceReductionRules