Potentially faulty Virus Definition Update causing issues win Block Win32 API calls from Office Macro ASR? Desktop shortcuts deleted out of the blue and Office executables disappearing.

In the last hour, we've had half our organisation report that shortcuts have disappeared from their desktop and Microsoft Office has ceased working. Outlook.exe has flat out disappeared for some.

Whilst not logged in Windows Defender->Operational, if we try to do a quick repair of Office we see that Windows Defender Exploit Guard has blocked the creation of .lnk files

From what I can see, this appears to be the "Block Win32 API calls from Office Macro" ASR rule malfunctioning, potentially after the installation of AntivirusSignatureVersion 1.381.2140.0

Is anyone else seeing similarly?

One one machine I've changed that rule to audit rather than block and Office repair has since been successful and the creation of .lnk files via our powershell scripts is functioning again..

Edit - this has also been reported at (5) Multiple users reporting Microsoft apps have disappeared : sysadmin (reddit.com) which I didn't see at the time. Nice to see my own theory borne out elsewhere tho. Remediation for this is going to be a nightmare. Where it's deleted shortcuts from OneDrive desktops it's easily remedied but this is also deleting shortcuts from C:\ProgramData\Microsoft\Windows\Start Menu\Programs for anything it doesn't like - even Edge.