Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 839576" data-attributes="member: 32260">&quot;Allow EXE and TMP&quot; is neither default-deny nor default-allow. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />But, that is my point of view. I do not use default-allow for it because it still uses SRP &quot;Default Security Level&quot; = Disallowed.SRP is a default-allow when SRP &quot;Default Security Level&quot; = Unrestricted. &quot;Allow EXE and TMP&quot; is similar to default-allow because most applications and installers are allowed (except blocked Sponsors). So, it behaves as default-allow in typical user actions. It is similar to default-deny because many file types (including MSI installers and scripts) are blocked by default. Furthermore, the PowerShell on Windows 10 runs in Constrained Language mode.I think that the below post (from a couple of months ago) was about it:[URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/shmu26-windows-config-in-2019.89148/post-819229[/URL]</blockquote>

[QUOTE="Andy Ful, post: 839576, member: 32260"] "Allow EXE and TMP" is neither default-deny nor default-allow. (y) But, that is my point of view. I do not use default-allow for it because it still uses SRP "Default Security Level" = Disallowed. SRP is a default-allow when SRP "Default Security Level" = Unrestricted. "Allow EXE and TMP" is similar to default-allow because most applications and installers are allowed (except blocked Sponsors). So, it behaves as default-allow in typical user actions. It is similar to default-deny because many file types (including MSI installers and scripts) are blocked by default. Furthermore, the PowerShell on Windows 10 runs in Constrained Language mode. I think that the below post (from a couple of months ago) was about it: [URL unfurl="false"]https://malwaretips.com/threads/shmu26-windows-config-in-2019.89148/post-819229[/URL] [/QUOTE]

Verification