Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1125172" data-attributes="member: 32260">It is possible that the &quot;Block executables...&quot; ASR rule somehow depends on &quot;ISG without a SmartScreen backend (files with no MOTW)&quot;. But this rule also depends on the file age. If the file is known in the Microsoft cloud for more than 24 hours, it will be allowed even if ISG still blocks it.There is no direct connection to SmartScreen. Both Cloud Protection Level and &quot;Block executables...&quot; ASR rule can block executables allowed by SmartScreen. For example, the ASR rule blocked my digitally signed applications a few times (allowed by SmartScreen).Edit.The ASR rule &quot;Block executables ...&quot; does not block MSI files and DLLs loaded by EXEs (cannot prevent DLL hijacking), but SAC (and WDAC ISG) can.When protecting happy clickers with an enabled rule &quot;Block executables ...&quot;, enabling also SAC makes sense.</blockquote>

[QUOTE="Andy Ful, post: 1125172, member: 32260"] It is possible that the "Block executables..." ASR rule somehow depends on "ISG without a SmartScreen backend (files with no MOTW)". But this rule also depends on the file age. If the file is known in the Microsoft cloud for more than 24 hours, it will be allowed even if ISG still blocks it. There is no direct connection to SmartScreen. Both Cloud Protection Level and "Block executables..." ASR rule can block executables allowed by SmartScreen. For example, the ASR rule blocked my digitally signed applications a few times (allowed by SmartScreen). Edit. The ASR rule "Block executables ..." does not block MSI files and DLLs loaded by EXEs (cannot prevent DLL hijacking), but SAC (and WDAC ISG) can. When protecting happy clickers with an enabled rule "Block executables ...", enabling also SAC makes sense. [/QUOTE]

Verification