AddDefenderPolicies.Policies.AddDefenderPolicies• Machine

Block JavaScript or VBScript from launching downloaded executable content

This rule prevents scripts from launching potentially malicious downloaded content. Malware written in JavaScript or VBScript often acts as a downloader to fetch and launch other malware from the Internet. Although not common, line-of-business applications sometimes use scripts to download and launch installers.

Policy Details

Policy Name: ExploitGuard_ASR_Rules_Script_Staging
Registry Key: Software\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\ASR\Rules
Supported On: At least Windows Server 2016, Windows 10 Version 1709
Available Languages: en-us fr-fr

Configuration Elements

ASR rule modes: Not configured or Disable: The state in which the ASR rule isn't enabled. Block: The state in which the ASR rule is enabled. Audit: The state in which the ASR rule is evaluated for the effect it would have on the organization or environment if enabled (set to block or warn). Warn: The state in which the ASR rule is enabled and presents a notification to the end-user, but permits the end-user to bypass the block.

Mode:

Type: enum

Allowed Values

0 Disabled
2 Audit
6 Warn
1 Block