Forum Discussion

brink668's avatar
brink668
Brass Contributor
Aug 03, 2022
Solved

ASR - Behavior Changes - Blocking under User Context Now?

Since July 7-27-2022 I have been seeing around 40 of 1800 machines in my work environment that are showing blocks under %userprofile% or usercontext for .dll blocks. This is new behavior and is rece...
  • FTurp's avatar
    FTurp
    Aug 15, 2022
    I've so far only managed to check on one endpoint that was having the issue, However it's Security Intelligence Version updated to 1.373.383.0 this morning and it is no longer showing any symptoms of the problem. So early signs are encouraging that this may be fixed.
shend141's avatar
shend141
Copper Contributor
Aug 10, 2022

Affecting us too and Microsoft have confirmed there is unexpected behaviour from their side with the rule, so hopefully they provide a fix asap brink668 

  • MikePalmer75's avatar
    MikePalmer75
    Brass Contributor
    Aug 10, 2022
    brink668 and shend141 we are just being hit with this issue but it appears to be only happening on far on a new Outlook plugin we are deploying to 3000 machines. We had the update rings paused due to an MS Edge and EMIE application guard issue and only enabled them last week.
    • shend141's avatar
      shend141
      Copper Contributor
      Aug 10, 2022

      This ASR issue is affecting our existing Outlook add-ins, we haven't deployed any new Outlook add-ins MikePalmer75 

      • MikePalmer75's avatar
        MikePalmer75
        Brass Contributor
        Aug 10, 2022
        Interesting as we have not heard anything yet regarding the existing ones. Do we know if this is an platform or anti-malware or definition update issue?

Resources