User Profile
TakedaShingen
Copper Contributor
Joined Aug 11, 2022
User Widgets
Recent Discussions
Re: ASR - Behavior Changes - Blocking under User Context Now?
ok to finish our experience: after 2 more fixes from microsoft we seem to be fine now some users that had problems dont have them anymore in reports -> ASR rules i also dont see any more blocks of our 3rd party software in "block exe content from email and webmail" so bit early to be sure but for now it looks like all is fixed for us4.2KViews0likes5CommentsRe: ASR - Behavior Changes - Blocking under User Context Now?
so for us microsoft replied: "WDSI Security Intelligence team have gotten back to me and provided the following solution: We have reviewed the reported issue, and this is known issue • And regarding ASR issues related to Block executable content from email client and webmail we have provided global fix. The changes will be reflected in the security intelligence version 1.373.181.0 or above. So, we request you to update to the latest security intelligence version and verify the issue. " so after updating a problem client indeed it changed. we get an all new error message and block event in the defender report.4.1KViews0likes4CommentsRe: ASR - Behavior Changes - Blocking under User Context Now?
the action plan was 1 taking logs 2 idicator whitelisting 3 taking logs again to get to the prob. we have another meeting with microsoft in 20 min and this time the agend knew about the possible product team fix. for this they want to pull logs again i believe. anyhow i keep sharing our experience 😄6.1KViews0likes14CommentsRe: ASR - Behavior Changes - Blocking under User Context Now?
same for us. we had tech support adding hash based indicators in defender365 -> settings -> indicators first we used hash from loaded plugin dll -> did not help today we added all dll from the plugin (condeco) -> didnt help currently we are waiting for additional microsoft support callback6.1KViews1like0CommentsRe: ASR - Behavior Changes - Blocking under User Context Now?
we have exactly the same issue for about one week. about 1-5 % of total clients affected so far but the number also seems to increase. different 3rd party plugins affected. waiting for response from ms incident manager6.8KViews0likes22Comments
Recent Blog Articles
No content to show