Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1032318" data-attributes="member: 32260">Such a BlockList would be relatively long (over 60 entries):AddInProcess, AddInProcess32, AddInUtil, Aspnet_Compiler, bash, bitsadmin, cdb, cmd, cmstp, csc, csi, dbghost, dbgsvd, dnx, finger, forfiles, fsi, FsiAnyCpu,&nbsp; hh, ieexec, iexplore,&nbsp; ilasm, InfDefaultInstall, InstallUtil, jsc, kd, kill, lxrun, Microsoft.Workflow.Compiler, msbuild, msdt, mshta, ntkd, ntsd, pnputil, powershell, PowerShellCustomHost, powershell_ise, PresentationHost, rcsi, reg, regasm, regini, regsvr32, RegSvcs, runas, rundll32, RunScriptHelper, sc, schtasks, SyncAppvPublishingServer, TextTransform, vbc, verclsid, VisualUiaVerifyNative, wfc, windbg, wmic, wsl, wslconfig, wslhost, xwizard.The list is longer than for WDAC, because H_C does not block DLLs (but blocks the files that could contain the CmdLines to run DLLs via LOLBins). If you use a setup that does not prevent running CmdLines, then you must also add the LOLBins that can run DLLs.I prefer the setup that can prevent access to CmdLine (as much as possible). This can be done via SRP in H_C and cannot be done via AppLocker or WDAC. That is why I included in enhanced settings only some popular LOLBins (probably unnecessary).Anyway, I can put some info about the extended set of LOLBins in the H_C manual.</blockquote>

[QUOTE="Andy Ful, post: 1032318, member: 32260"] Such a BlockList would be relatively long (over 60 entries): AddInProcess, AddInProcess32, AddInUtil, Aspnet_Compiler, bash, bitsadmin, cdb, cmd, cmstp, csc, csi, dbghost, dbgsvd, dnx, finger, forfiles, fsi, FsiAnyCpu, hh, ieexec, iexplore, ilasm, InfDefaultInstall, InstallUtil, jsc, kd, kill, lxrun, Microsoft.Workflow.Compiler, msbuild, msdt, mshta, ntkd, ntsd, pnputil, powershell, PowerShellCustomHost, powershell_ise, PresentationHost, rcsi, reg, regasm, regini, regsvr32, RegSvcs, runas, rundll32, RunScriptHelper, sc, schtasks, SyncAppvPublishingServer, TextTransform, vbc, verclsid, VisualUiaVerifyNative, wfc, windbg, wmic, wsl, wslconfig, wslhost, xwizard. The list is longer than for WDAC, because H_C does not block DLLs (but blocks the files that could contain the CmdLines to run DLLs via LOLBins). If you use a setup that does not prevent running CmdLines, then you must also add the LOLBins that can run DLLs. I prefer the setup that can prevent access to CmdLine (as much as possible). This can be done via SRP in H_C and cannot be done via AppLocker or WDAC. That is why I included in enhanced settings only some popular LOLBins (probably unnecessary). Anyway, I can put some info about the extended set of LOLBins in the H_C manual. [/QUOTE]

Verification