MS Cockup - Disappearing Shortcuts - ASR Rule

[markberry]

Microsoft have released an update to their Defender definitions this morning. Defender is now actively deleting Windows shortcuts! The Anti-virus becomes the virus!!! Happy Friday 13th!

 

Anyone with deleting shortcuts across the enterprise change ASR rule 'Block Win32 API Calls from Office Macro' (ASR rule 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b) to "2" or audit mode. See microsoft MO497128

 

Not sure how to restore shortcuts yet!

[MatZeRO]

We have this issue. Our Start Menus are emptying. Also if you access a machine via share the rule kicks in and removes the shortcuts.

 

Temporarily we have created a shared folder and dropped shortcuts in for Staff to continue to access the shortcuts.

 

We have also blocked the Defender rule.

[markberry]

It's an absolute PITA! So many organisations have been hit. We're just writing a script to copy back missing shortcuts because I don't hold out much of Microsoft being able to fix the shortcuts!

[MatZeRO]

Good write up on this here: https://www.neowin.net/news/microsoft-reminds-all-its-friday-the-13th-as-defender-deletes-shortcuts-on-windows-10/

[Andrew_C]

Well done M$!

 

ETA - El Reg

Edited January 13, 2023 by Andrew_C

[DalekSec]

Rebuilt a laptop this morning a user who was having this issue as was unsure what it was and went with it being a windows corruption issue, then 30mins after built and swapped another user mentioned it... and found it was ASR assumed was the rules i applied last week ... then saw this on twitter!!!!

[Dan_ATR]

In intune, set the following to Audit

 

"Win32 imports from Office macro code"

 

From MS int he admin pannel:

 

January 13, 2023 2:39 PM

 

Title: Some users are unable to utilize the Application shortcuts on the Start menu and taskbar

 

User Impact: Users are unable to utilize the Application shortcuts on the Start menu and taskbar.

 

More info: The shortcut icons may not appear or would not work.

 

While we investigate the underlying issue, users can directly launch Office Apps by using the Office App, or through the Microsoft 365 app launcher. More details on the Microsoft 365 app launcher can be found https://support.microsoft.com/en-us/office/meet-the-microsoft-365-app-launcher-79f12104-6fed-442f-96a0-eb089a3f476a

 

We recommend that you put the ASR rule to Audit Mode to avoid further impact. This can be done through the following options:

- Using Powershell: Add-MpPreference -AttackSurfaceReductionRules_Ids 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b -AttackSurfaceReductionRules_Actions AuditMode

- Using Intune: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#mem

- Using Group Policy: https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/enable-attack-surface-reduction?view=o365-worldwide#group-policy

- Note that ASR rule "Block Win32 API calls from Office macros" with ID: 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b

 

You can also set the rule to disabled mode. In that case, please use the following Powershell command:

Add-MpPreference -AttackSurfaceReductionRules_Ids 92e97fa1-2edf-4476-bdd6-9dd0b4dddc7b -AttackSurfaceReductionRules_Actions Disabled

 

Current status: We reverted the offending ASR rule, however, this change is propagating throughout the environment and could take several hours to complete. We recommend that you take action to place the offending ASR rule into Audit Mode and prevent further impact until the update has completed deployment. Further information on how to perform these steps are listed within the More info section of this communication.

 

Scope of impact: Impact is specific to some users who are served through the affected infrastructure.

 

Next update by: Friday, January 13, 2023, 4:00 PM (4:00 PM UTC)

[free780]

There is a repair script.

 

https://techcommunity.microsoft.com/t5/microsoft-defender-for-endpoint/recovering-from-attack-surface-reduction-rule-shortcut-deletions/ba-p/3716011

[titch]

Side note: would be interested to see what you guys sent out to your end users. Tone and explanation etc? Anyone willing to share?

[chaplic]

It’s not much of a repair script. The whole response from MS is wholly unacceptable

 

For us, it looks like it’s mainly nuked some meta folder directory and shortcuts from the desktop, which are fortunately onedrive synced so I’ve just restored them and also done a proactive remediation to fix where it detects missing office shortcut, but I only found out about 3:30pm on Friday so I guess we’ll see.

[titch]

Assuming the apps are still there. If you search for them in from the start menu they will show up? Figuring out how we hit this in the morning.

[MatZeRO]

No they don't show up when you search for them.

[3s-gtech]

Mine was on audit mode already, by luck more than judgment!

[TechMonkey]

Side note: would be interested to see what you guys sent out to your end users. Tone and explanation etc? Anyone willing to share?

 

We didn't get a chance to really put anything out about this, we had a couple of reports, but more an FYI to us as users weren't prevented from doing anything they were just being bugged by the messages. By the time MS admitted there was an issue it was end of day. We are just following up today to check users are all OK this morning.

 

This may be due to our setup though as we tend to have shortcuts copied into a folder and redirect start to that. Shortcuts are then replaced if missing.

[kevin_lane]

i don't know if it is related, or not but we have had few PCs where they have blue screened and are just in a loop, we are having to do a reset on them, also have noticed a machine where by the icons on the start menu have disappeared and just left with some app value, really odd have enabled the audit mode in our sccm portal, I'm just hoping i don't come in tomorrow and its even worse

[Ellisio]

We had a few in our org - shame I didn't see this before.

 

Like others, we put it down to Windows corruption and have reimaged a handful of devices...