Getting Windows defender intelligence version to skip buggy ASR rule

zebal · Nov 28, 2023

You surely recall the buggy ASR rule that deleted user's shortcuts?

Recovering from Attack Surface Reduction rule shortcut deletions

Guidance on how to recover from short-cut deletions including PowerShell script.

techcommunity.microsoft.com

The link above outlines this bug and also says this bug will trigger for intelligence builds between 1.381.2134.0 and 1.381.2163.0.

On January 13th, Windows Security and Microsoft Defender for Endpoint customers may have experienced a series of false positive detections for the Attack Surface Reduction (ASR) rule "Block Win32 API calls from Office macro" after updating to security intelligence builds between 1.381.2134.0 and 1.381.2163.0.

I need to programmatically determine if current computer is using the specified "intelligence builds" in PowerShell and if so then I skip enabling this ASR rule.
My problem is that it's unclear what is "intelligence build"?

To get current Windows Defender versions I can run:

Powershell:

Get-MpComputerStatus | select AMProductVersion, AMEngineVersion, AntivirusSignatureVersion, AntispywareSignatureVersion | fl

Get-MpComputerStatus (Defender)

Use this topic to help manage Windows and Windows Server technologies with Windows PowerShell.

learn.microsoft.com

Example output:

Powershell:

AMProductVersion            : 4.18.23100.2009
AMEngineVersion             : 1.1.23100.2009
AntivirusSignatureVersion   : 1.401.1324.0
AntispywareSignatureVersion : 1.401.1324.0

Which of those 4 numbers listed in the output above correspond to "intelligence build" that was affecting the ASR rule?
Perhaps it is some other property which I didn't include in the sample output.

Same data can be obtained in Windows Defender app in:
Open Windows Defender app -> click "settings" on the bottom left -> click "About" link

oldschool · Nov 28, 2023

The latter 2 are the definition versions. You can see the the numbering sequence is the same.

zebal · Nov 28, 2023

oldschool said:
The latter 2 are the definition versions. You can see the the numbering sequence is the same.

And I only assume it is those versions which are referred to as "intelligence builds"

Problem however is that I'm not 100% sure and there is no guarantee both versions will always be the same unless there is some official statement they will be always the same.

Yeah, the pattern seems to favor these.

oldschool · Nov 28, 2023

zebal said:
I only assume it is those versions which are referred to as "intelligence builds"

Yes, but not exactly because this also includes Engine Version and Platform Version. For instance:

So Client Version is = Platform Version in Windows Security > About
https://www.microsoft.com/en-us/wdsi/defenderupdates

Did you experience the bug and lose shortcuts you linked in your OP?

zebal · Nov 29, 2023

oldschool said:
Did you experience the bug and lose shortcuts you linked in your OP?

Yes I did, had to reinstall Windows because was not fond of fixing it.

I'm maintaining a script that deploys this rule and I just want to handle the case if system is out of date and disable it.

I think it's safe to assume that AntispywareSignatureVersion and AntivirusSignatureVersion correspond to "intelligence builds" because number patterns match, this corresponds to Version from your screenshot.

Thanks for help!