Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1029730" data-attributes="member: 32260">I doubt if there are such sources, except for some posts scattered on the MT forum.WDAC ISG has got a special treatment of executables with MOTW. If SmartScreen allows the installer downloaded from the Internet, then ISG will also allow the Exe and DLL files executed by the installer (with some exceptions). Without the MOTW, the SmartScreen ignores the installer, and the installation would be broken if some of the Exe or Dll files tried to execute (while not allowed by ISG).On the contrary, SAC mostly allows the initial installer if it is allowed by SmartScreen (SmartScreen is a part of SAC), but does not automatically allow the Exe and Dll files dropped/loaded/executed during the installation.I often used this behavior to fool WDAC. Many applications (installed in UserSpace) blocked normally by WDAC ISG, could be still executed by using RunBySmartscreen. This cannot be done for applications installed in %ProgramFiles% because RunBySmartscreen does not add MOTW in this location.Post corrected.</blockquote>

[QUOTE="Andy Ful, post: 1029730, member: 32260"] I doubt if there are such sources, except for some posts scattered on the MT forum. WDAC ISG has got a special treatment of executables with MOTW. If SmartScreen allows the installer downloaded from the Internet, then ISG will also allow the Exe and DLL files executed by the installer (with some exceptions). Without the MOTW, the SmartScreen ignores the installer, and the installation would be broken if some of the Exe or Dll files tried to execute (while not allowed by ISG). On the contrary, SAC mostly allows the initial installer if it is allowed by SmartScreen (SmartScreen is a part of SAC), but does not automatically allow the Exe and Dll files dropped/loaded/executed during the installation. I often used this behavior to fool WDAC. Many applications (installed in UserSpace) blocked normally by WDAC ISG, could be still executed by using RunBySmartscreen. This cannot be done for applications installed in %ProgramFiles% because RunBySmartscreen does not add MOTW in this location. Post corrected. [/QUOTE]

Verification