Sunturai
Back to results
InformationalSplunk security contentMichael Haag +1

Windows Defender ASR Block Events

This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after…

Description

This detection searches for ASR block events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. Typically, these will be enabled in block most after auditing and tuning the ASR rules themselves.

Detection logic

Detection requirements

Platform
ContainersESXiIaaSIdentity ProviderLinuxmacOSNetwork DevicesOffice SuiteSaaSWindows

The rule states no platform. This is derived from the 2 ATT&CK techniques it maps to.

Log source category
windows_event_log_defender_1121windows_event_log_defender_1126windows_event_log_defender_1129windows_event_log_defender_1131windows_event_log_defender_1133

Known benign triggers

  • Some false positives are expected initially as the ASR rules are tuned and configured.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice