Block execution of potentially obfuscated scripts

Purpose

Show registry keys (1)

• HKLM\Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules\5beb7efe-fd9a-4556-801d-275e5ffc04cc

This DWORD value controls the Microsoft Defender attack surface reduction rule identified by 5beb7efe-fd9a-4556-801d-275e5ffc04cc. A value of 1 enables the rule in Block mode.

The rule detects suspicious characteristics in potentially obfuscated scripts and prevents those scripts from running. Obfuscation changes how script code is represented, making its actual behavior more difficult to examine. This rule does not prohibit scripts in general; it intervenes when Microsoft Defender detects relevant suspicious properties.

Notes

Security

Attackers commonly obfuscate scripts to conceal malicious behavior and impede analysis by people and security software. Blocking scripts detected in this way reduces the opportunity for disguised malicious code to execute.

The rule does not necessarily identify every malicious or obfuscated script, and it does not replace antivirus protection or other security controls.

Possible side effects

Legitimate applications can also use script obfuscation, for example to protect intellectual property or reduce script loading times. If Microsoft Defender detects suspicious properties in such a script, the rule can block it as well. Affected script-based applications or automation processes might consequently fail or operate only partially.

Notes

The rule depends on Microsoft Defender Antivirus, Antimalware Scan Interface (AMSI), and cloud-delivered protection. Cloud-delivered protection must be available and enabled for the rule to operate. Microsoft explicitly documents support for PowerShell scripts.

Microsoft documentation

Microsoft Learn: Attack surface reduction (ASR) rules reference

Microsoft Learn: Attack surface reduction (ASR) rules overview

See also

• Entry in the reference