A city CISO asks analysts why some AI-mutated scripts still get caught after they evade hash signatures. What explanation fits best in a Defender-aware briefing?

City CISOs briefing Defender-aware teams need a clear separation between static and behavioral control planes. AI-mutated scripts can evade hash signatures by changing content fingerprints, yet Microsoft Defender Attack Surface Reduction (ASR) rules still evaluate risky behaviors—such as obfuscated script execution patterns, suspicious child process creation, or other rule-matched actions—independent of whether the file hash matches a known-bad list. That is why some mutated samples are still caught: the behavioral ASR layer does not require a prior hash hit to intervene.

Hash evasion does not automatically disable ASR rules citywide; those are distinct configuration surfaces. It is false that once a hash changes no Defender feature can observe script behavior—behavior-based features remain relevant. AI mutation also does not replace ASR with signature-only scanning; mutation targets content identity, not the product architecture that includes behavioral rules.

Exam caveat: the stem asks why some AI-mutated scripts still get caught after hash evasion. The answer is behavioral ASR (and similar behavior-centric defenses), not a claim that hashes somehow shut off Defender or that mutation removes ASR from the stack.

Operational check for municipal briefings: in an authorized lab, take a known hash-detectable sample, mutate it until the hash no longer matches, then re-test with ASR-relevant rules enabled versus disabled under ROE. Document which behaviors still trigger blocks. Use those results to argue for layered Defender configuration on city fleets rather than hash-catalog reliance alone.