Reply to thread

Message

<blockquote data-quote="oldschool" data-source="post: 814301" data-attributes="member: 71262">[USER=32260]@Andy Ful[/USER] [USER=37647]@shmu26[/USER] or other members:I thought there were 3 or 4 ASR rules that did not previously support exclusions and now I see only two in the new CD version. I don&#039;t remember the lsass.exe rule being one where they&#039;re allowed. Or Is my mind simply scrambled from too much time in front of a screen? <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite117" alt=":eek:" title="Eek!&nbsp; &nbsp; :eek:" loading="lazy" data-shortname=":eek:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite113" alt=":confused:" title="Confused&nbsp; &nbsp; :confused:" loading="lazy" data-shortname=":confused:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite113" alt=":confused:" title="Confused&nbsp; &nbsp; :confused:" loading="lazy" data-shortname=":confused:" />My other query: I seem to remember that the log can show a block but that it doesn&#039;t automatically = an attempted action not completed.&nbsp; My two questions are in reference to the well-known, persnickety lsass.exe rule. I&#039;m either asleep at the wheel or my brain is scrambled!</blockquote>

[QUOTE="oldschool, post: 814301, member: 71262"] [USER=32260]@Andy Ful[/USER] [USER=37647]@shmu26[/USER] or other members: I thought there were 3 or 4 ASR rules that did [I]not [/I]previously support exclusions and now I see only two in the new CD version. I don't remember the lsass.exe rule being one where they're allowed. Or Is my mind simply scrambled from too much time in front of a screen? :emoji_astonished::confused::confused: My other query: I seem to remember that the log can show a block but that it [I]doesn't[/I] automatically = an attempted action not completed. My two questions are in reference to the well-known, persnickety lsass.exe rule. I'm either asleep at the wheel or my brain [I]is[/I] scrambled! [/QUOTE]

Verification