Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1012852" data-attributes="member: 32260">There is no rule for cmd[.]exe - I had to remove it from my post due to Malware Tips restrictions. The posts that use the name of the CMD executable (as a part of the code ) are rejected for security reasons.You can use the fake rule for HH.EXE:[CODE]&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a9600d&quot; Name=&quot;HH.EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;HomeApplocker:HH.EXE&quot; BinaryName=&quot;HH.EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;[/CODE]After editing the above rule, the rule for cmd[.]exe should look as follows (skip the brackets [ ] in the Name and BinaryName of CMD executable):[CODE]&nbsp; &nbsp; &lt;FilePublisherRule Id=&quot;f493e22c-63a9-4811-ab94-c5d8a8a9600d&quot; Name=&quot;CMD[.]EXE&quot; Description=&quot;&quot; UserOrGroupSid=&quot;S-1-1-0&quot; Action=&quot;Deny&quot;&gt;&nbsp; &nbsp; &nbsp; &lt;Conditions&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;FilePublisherCondition PublisherName=&quot;O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US&quot; ProductName=&quot;*&quot; BinaryName=&quot;CMD[.]EXE&quot;&gt;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &lt;BinaryVersionRange LowSection=&quot;*&quot; HighSection=&quot;*&quot; /&gt;&nbsp; &nbsp; &nbsp; &nbsp; &lt;/FilePublisherCondition&gt;&nbsp; &nbsp; &nbsp; &lt;/Conditions&gt;&nbsp; &nbsp; &lt;/FilePublisherRule&gt;[/CODE]Warning!!!I strongly recommend making a System Restore Point before applying the Applocker rules.</blockquote>

[QUOTE="Andy Ful, post: 1012852, member: 32260"] There is no rule for cmd[.]exe - I had to remove it from my post due to Malware Tips restrictions. The posts that use the name of the CMD executable (as a part of the code ) are rejected for security reasons. You can use the fake rule for HH.EXE: [CODE] <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a9600d" Name="HH.EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="HomeApplocker:HH.EXE" BinaryName="HH.EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule>[/CODE] After editing the above rule, the rule for cmd[.]exe should look as follows ([B][COLOR=rgb(184, 49, 47)]skip the brackets [ ][/COLOR][/B] in the Name and BinaryName of CMD executable): [CODE] <FilePublisherRule Id="f493e22c-63a9-4811-ab94-c5d8a8a9600d" Name="CMD[.]EXE" Description="" UserOrGroupSid="S-1-1-0" Action="Deny"> <Conditions> <FilePublisherCondition PublisherName="O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US" ProductName="*" BinaryName="CMD[.]EXE"> <BinaryVersionRange LowSection="*" HighSection="*" /> </FilePublisherCondition> </Conditions> </FilePublisherRule>[/CODE] [B][COLOR=rgb(184, 49, 47)]Warning!!! I strongly recommend making a System Restore Point before applying the Applocker rules.[/COLOR][/B] [/QUOTE]

Verification