Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 707803" data-attributes="member: 32260">Yes, It does not make sense for the Permissive mode, but is required for Expert and Standard modes.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />ReHips list includes many processes from the Bouncer blacklist, but also many other. This is possible because all processes on the list are allowed to run (in Permissive mode) and only some of them cannot execute programs (subprograms).I thought that in Permissive mode there will be no alerts, but it is not true. Rarely, some programs can cause alerts when executing sub-programs (bcdedit.exe, cmd.exe, cscript.exe, dvsvc.exe,&nbsp; InstallUtil.exe, mmc.exe, msdt.exe, mshta.exe, msiexec.exe, netsh.exe, PresentationHost.exe, reg.exe, regedit.exe, RegAsm.exe, RegSvcs.exe, regsvr32.exe, rundll32.exe, setx.exe, wscript.exe, wusa.exe).</blockquote>

[QUOTE="Andy Ful, post: 707803, member: 32260"] Yes, It does not make sense for the Permissive mode, but is required for Expert and Standard modes.:) ReHips list includes many processes from the Bouncer blacklist, but also many other. This is possible because all processes on the list are allowed to run (in Permissive mode) and only some of them cannot execute programs (subprograms). I thought that in Permissive mode there will be no alerts, but it is not true. Rarely, some programs can cause alerts when executing sub-programs (bcdedit.exe, cmd.exe, cscript.exe, dvsvc.exe, InstallUtil.exe, mmc.exe, msdt.exe, mshta.exe, msiexec.exe, netsh.exe, PresentationHost.exe, reg.exe, regedit.exe, RegAsm.exe, RegSvcs.exe, regsvr32.exe, rundll32.exe, setx.exe, wscript.exe, wusa.exe). [/QUOTE]

Verification