Quantum XL — Windows Defender ASR Rules

Quantum XL requires read/write access to the Windows Registry and the ability to create child processes (DLLs). For most users this is not a problem. However, IT departments who implement the following Attack Surface Reduction (ASR) rules will not be able to run Quantum XL.

• Rule {D4F940AB-401B-4EFC-AADC-AD5F3C50688A} — "Block all Office applications from creating child processes"
• Rule {92E97FA1-2EDF-4476-BDD6-9DD0B4DDDC7B} — "Block Win32 API calls from Office macros"

Depending on the configuration of the user's PC, a variety of errors can occur. Other security applications have similar settings under different titles.

Solution

• Exclude the installation folder: "%Program Files(x86)%"\SigmaZone\Quantum XL (typically C:\Program Files (x86)\SigmaZone\Quantum XL). This is typically done through PowerShell with the command below, but contact your IT staff for assistance.

  Add-MpPreference -AttackSurfaceReductionOnlyExclusions 'C:\Program Files (x86)\SigmaZone\Quantum XL'

• Or exclude all of the .xlam files in "%Program Files(x86)%"\SigmaZone\Quantum XL.

Resources

• Microsoft Article — Configure and validate exclusions based on file extension and folder location
• Microsoft Article — Enable attack surface reduction rules