What's Changed

• Set Block use of copied or impersonated system tools Attack Surface Reduction rule to Warn and block instead of block. In this mode, it will block the action but display a notification toast allowing you to unblock the action if you want. It's in preview state so this change should allow you to have more control over its operation in case it inadvertently blocks a process. If you want to apply this new change just run the ASR category again.

  • The compliance checking marks this ASR rule as compliant if it's either in warn & block or block mode.

Thanks to @agpt8 for the post about this.

PR: #220