Is the method described in your CSO article How to Use Windows Defender Attack Surface Reduction Rules the appropriate way to enable the “ Block Office application from creating child processes” rule on my system, namely: I have a Win 10 Pro v21H2 OS and MS Office 2019 Home and Business C2R. I have never had any version of Office installed so maybe that’s why.įirst off understand that this is a “get more rights” type of attack that will be more targeted than used in widespread attacks. Some saying the key only exists if Office is installed or specific versions of Office even though the software is present on the system. It’s another reminder to not open anything one doesn’t recognise, same as it ever was.Įdit: Actually, regarding ScriptedDiagnostics – i have had the troubleshooting wizard in action centre disabled for years so maybe that’s why it’s not listed.Įdit2: I noticed a number of users over on the ArsTechnica article also don’t have the ms-msdt registry key – However, the search-ms entry is present in the correct location. Neither does the ScriptedDiagnostics entry exist for me but i just assumed that’s only for newer Windows versions. This is on a Win7 system by the way, does anyone else not see it? So to speak. Attempting to backup the ms-msdt entry results in an error message that it cannot be found and sure enough, it’s not listed in the registry.

Malwarebytes manual update rules.ref