Reply to thread

Message

<blockquote data-quote="Deleted member 65228" data-source="post: 734692">[USER=37647]@shmu26[/USER] Yes, I do recommend enabling both of those. I think it would be a wise decision. However, make sure for all the rules you enable that can be applied without breaking any functionality you require. It wouldn&#039;t be a bad idea either to want more insight into how the rules work for the future in-case an issue ever occurs.By the way, the official documentation states the following.Therefore, any environment on Windows 10 which is not on that build or higher, will not have access to the following rules.From what I understand of the naming for the rule, it will block all process creation originating from PSExec (from SysInternals) or WMI usage, regardless of how it is being performed by PSExec/WMI usage.However, I believe PSExec became a target by Microsoft for the ASR rules due to the abuse it has within malware attacks from the past (and likely still current). Not to mention that PSExec will be more than happy to spawn any target process under NT Authority Account (SYSTEM) when using the &quot;-s&quot; argument correctly (which is what that argument is for).The note from the official Microsoft documentation is as follows.That appears to be all they provide about it, apart from a brief disclaimer afterwards about functionality of something else.</blockquote>

[QUOTE="Deleted member 65228, post: 734692"] [USER=37647]@shmu26[/USER] Yes, I do recommend enabling both of those. I think it would be a wise decision. However, make sure for all the rules you enable that can be applied without breaking any functionality you require. It wouldn't be a bad idea either to want more insight into how the rules work for the future in-case an issue ever occurs. By the way, the official documentation states the following. Therefore, any environment on Windows 10 which is not on that build or higher, will not have access to the following rules. From what I understand of the naming for the rule, it will block all process creation originating from PSExec (from SysInternals) or WMI usage, regardless of how it is being performed by PSExec/WMI usage. However, I believe PSExec became a target by Microsoft for the ASR rules due to the abuse it has within malware attacks from the past (and likely still current). Not to mention that PSExec will be more than happy to spawn any target process under NT Authority Account (SYSTEM) when using the "-s" argument correctly (which is what that argument is for). The note from the official Microsoft documentation is as follows. That appears to be all they provide about it, apart from a brief disclaimer afterwards about functionality of something else. [/QUOTE]

Verification