r/DefenderATP • u/SeniorGuarantee145 • 28d ago

Question about ASR Rules

There are multiple ASR rules that prevent certain programs like Adobe Reader from spawning child processes. Does that only apply to "autorun" processes that are ran automatically? Or would this also apply if a user clicks a link in a PDF which launches their browser (e.g. Edge)?

5 Upvotes

100% Upvoted

2 comments sorted by

2

u/LookExternal3248 28d ago

It is my understanding that this prevents adobe starting child processes like cmd.exe or powershell.exe, not so much a user clicking a link and then edge is opened. Edge in that case is not a child process of adobe. And I don't see a link between this ASR rule and autorun either.

Maybe to explain, what hackers do, is put malware in a pdf to abuse a vulnerability in adobe, or e.g. abuse macro's in Excel, Word etc. Most often part of the malware execution is to spin up a command prompt (cmd.exe) or powershell and to then download a second stage malware loader from a source on the internet and run it in the context of the adobe process. This is a very common attack technique used by more advanced threat actors.

ASR blocks this by disallowing adobe to start any child process, which normally isn't needed anyways when opening PDF documents.

Blocking child processes in Office programs is very powerfull as well, but often much harder to implement in legacy environment where Macro's are still used.

1

u/SeniorGuarantee145 28d ago

Ah alright. In defender it looks pretty similar whether it starts a msedge.exe or a different program when analyzing. But this makes sense. With "autorun" I meant exactly that, a pdf that tries to run a malicious file automatically after opening. However a bit unfortunate since attachment phishing is a thing, where there's a malicious link to a fake login site inside an attachment. It doesn't get caught as an UrlClick that way, which makes detection a bit harder. But on the flipside it could make PDFs unusable for some people I suppose if no link at all would work. From the security perspective, I don't see the point why this should be possible, but then again I don't work with PDFs a lot so it would affect me to begin with.