Reply to thread

Message

<blockquote data-quote="ForgottenSeer 97327" data-source="post: 1032521">[USER=32260]@Andy Ful[/USER] and [USER=71262]@oldschool[/USER]I have enabled Code Integrity Guard fora) Important system processes also running at Medium ILsvchost.exeexplorer.exesihost.exedllhost.exeUserOOBEBroker.exeRuntimeBroker.exeApplicationFrameHost.exeb) Powerful system processes (are blocked to run as standard user by SRP)rundll32.exe (running DLL&#039;s)regsvr32.exe (registering DLL&#039;s)regini (setting/changing registry values/permission)cacls and icacls.exe (setting file permissions)forfiles (passing arguments/commands to files)powershell.exe (it is the only command processor I have not disabled)c) Processes which are nearly always running (and might be tempted to target by a sarcastic malware writer)smartscreen.exeSecurityHealthSystray.exewidgets.exed) Windows processes easy to target, because every Windows&nbsp; PC has themWrite.exeNotepad.exeMSpaint.exeCalc.exee) Microsoft Office programs and Edge broker process (renderer has SIG enabled by default) for same reason (most of corporate PC&#039;s have them)This is only possible when you use Microsoft Defender as Antivirus, because many 3p Antivirus inject DLL&#039;s in vulnarable processes.This is based on information I found on a website for admins (I forgot which) where admins shared info on which processes could be added to Code Integrity without running into performance or compatibilty problems. When I recall correctly they used three two for selecting the processes1. System processes to important not to run in a pristine state (only running Microsoft signed or co-signed stuff) = (my a and b)2. Processes nearly always running in medium IL&nbsp; (= my&nbsp; c) or installed&nbsp; (my d and e)&nbsp; these are the often attacked because malware writers know they are on a PC.They considered the best prestine state as running virtualized, the second as Protected Process and third with Code Integrity Guard</blockquote>

[QUOTE="ForgottenSeer 97327, post: 1032521"] [USER=32260]@Andy Ful[/USER] and [USER=71262]@oldschool[/USER] I have enabled Code Integrity Guard for a) Important system processes also running at Medium IL svchost.exe explorer.exe sihost.exe dllhost.exe UserOOBEBroker.exe RuntimeBroker.exe ApplicationFrameHost.exe b) Powerful system processes (are blocked to run as standard user by SRP) rundll32.exe (running DLL's) regsvr32.exe (registering DLL's) regini (setting/changing registry values/permission) cacls and icacls.exe (setting file permissions) forfiles (passing arguments/commands to files) powershell.exe (it is the only command processor I have not disabled) c) Processes which are nearly always running (and might be tempted to target by a sarcastic malware writer) smartscreen.exe SecurityHealthSystray.exe widgets.exe d) Windows processes easy to target, because every Windows PC has them Write.exe Notepad.exe MSpaint.exe Calc.exe e) Microsoft Office programs and Edge broker process (renderer has SIG enabled by default) for same reason (most of corporate PC's have them) This is only possible when you use Microsoft Defender as Antivirus, because many 3p Antivirus inject DLL's in vulnarable processes. This is based on information I found on a website for admins (I forgot which) where admins shared info on which processes could be added to Code Integrity without running into performance or compatibilty problems. When I recall correctly they used three two for selecting the processes 1. System processes to important not to run in a pristine state (only running Microsoft signed or co-signed stuff) = (my a and b) 2. Processes nearly always running in medium IL (= my c) or installed (my d and e) these are the often attacked because malware writers know they are on a PC. They considered the best prestine state as running virtualized, the second as Protected Process and third with Code Integrity Guard [/QUOTE]

Verification