Windows Defender ASR blocks IntelliJ IDEA JBR klist.exe

Problem

Windows Defender Attack Surface Reduction (ASR) rule "Block use of copied or impersonated system tools" (GUID: c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb) blocks execution of klist.exe shipped with IntelliJ IDEA’s bundled JetBrains Runtime (JBR) on Windows 11 endpoints (example path: C:\Program Files\JetBrains\IntelliJ IDEA 2026.2.3\jbr\bin\klist.exe). This prevents IntelliJ IDEA from being used in environments where the ASR rule is enabled.

Cause

IntelliJ IDEA bundles an OpenJDK tool named klist.exe. This file shares the same filename as Windows’ native klist.exe located in %windir%\System32 , but it is not a copy of that file.

Per Microsoft documentation for this ASR rule, executables in %windir%\System32 and %windir%\SysWOW64 are treated as system tools, and the rule can block copies or files with the same names when run from other locations—even if signed by a trusted vendor. A block indicates a match to the rule criteria and does not necessarily mean the file is malicious.

Reference:

https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference#block-use-of-copied-or-impersonated-system-tools

This ASR rule treats executable files in the Windows system directories %windir%\System32 and %windir%\SysWOW64 as Windows system tools. The rule blocks copies or files with the same names when they run from other locations, even if the files are signed by Microsoft or another trusted vendor.

The rule can also use heuristic criteria to classify and block legitimate third-party executables as system-tool-like based on their location and behavior. For example, an executable might be blocked when it runs from a nondefault or custom installation path instead of its expected location. A block indicates that the executable matched the rule criteria, not that the executable is necessarily malicious. Diagnostic logs might not identify the exact matching condition that caused the block.

If you confirm that a blocked file is legitimate, add a global or per-rule ASR exclusion for the affected file or folder. For more information, see File and folder exclusions for ASR rules.

Resolution

Use the guide here to exclude this file, which is advised by this ASR rule here.