Getting Windows defender intelligence version to skip buggy ASR rule

You surely recall the buggy ASR rule that deleted user's shortcuts?

The link above outlines this bug and also says this bug will trigger for intelligence builds between 1.381.2134.0 and 1.381.2163.0.

On January 13th, Windows Security and Microsoft Defender for Endpoint customers may have experienced a series of false positive detections for the Attack Surface Reduction (ASR) rule "Block Win32 API calls from Office macro" after updating to security intelligence builds between 1.381.2134.0 and 1.381.2163.0.

Click to expand...

I need to programmatically determine if current computer is using the specified "intelligence builds" in PowerShell and if so then I skip enabling this ASR rule.
My problem is that it's unclear what is "intelligence build"?

To get current Windows Defender versions I can run:


Example output:

Which of those 4 numbers listed in the output above correspond to "intelligence build" that was affecting the ASR rule?
Perhaps it is some other property which I didn't include in the sample output.

Same data can be obtained in Windows Defender app in:
Open Windows Defender app -> click "settings" on the bottom left -> click "About" link

The latter 2 are the definition versions. You can see the the numbering sequence is the same.

oldschool said:

The latter 2 are the definition versions. You can see the the numbering sequence is the same.

Click to expand...

And I only assume it is those versions which are referred to as "intelligence builds"

Problem however is that I'm not 100% sure and there is no guarantee both versions will always be the same unless there is some official statement they will be always the same.

Yeah, the pattern seems to favor these.

zebal said:

I only assume it is those versions which are referred to as "intelligence builds"

Click to expand...

Yes, but not exactly because this also includes Engine Version and Platform Version. For instance:

So Client Version is = Platform Version in Windows Security > About
https://www.microsoft.com/en-us/wdsi/defenderupdates

Did you experience the bug and lose shortcuts you linked in your OP?

oldschool said:

Did you experience the bug and lose shortcuts you linked in your OP?

Click to expand...

Yes I did, had to reinstall Windows because was not fond of fixing it.

I'm maintaining a script that deploys this rule and I just want to handle the case if system is out of date and disable it.

I think it's safe to assume that AntispywareSignatureVersion and AntivirusSignatureVersion correspond to "intelligence builds" because number patterns match, this corresponds to Version from your screenshot.

Thanks for help!