Reply to thread

Message

<blockquote data-quote="Windows_Security" data-source="post: 702118" data-attributes="member: 50782">Example of how wannabee cook (me <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite131" alt="(n)" title="Thumbs down&nbsp; &nbsp; (n)" loading="lazy" data-shortname="(n)" />) thinks he can beat a star chef (Andreas <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />) in a masterchef cook-offI disabled configuration rule &quot;Basic anti-exploit protection (parent-&gt;child process) because only office is mentioned and I want to include chrome also and the rule &quot;Prevent Adobe Acrobat from running MS office applications&quot; because I use SumatraPDF reader and don&#039;t want to my PDF reader to start any process.So I created some custom block rules . . .; Block rich content processing programs starting other programs[%PROCESS%: *] [%PARENTPROCESS%: *\SumatraPDF.exe][%PROCESS%: *] [%PARENTPROCESS%: *\WMPlayer.exe][%PROCESS%: *] [%PARENTPROCESS%: *\winword.exe][%PROCESS%: *] [%PARENTPROCESS%: *\excel.exe][%PROCESS%: *] [%PARENTPROCESS%: *\powerpnt.exe][%PROCESS%: *] [%PARENTPROCESS%: *\outlook.exe][%PROCESS%: *] [%PARENTPROCESS%: *\chrome.exe]. . . and some custom Exclusion rules; Allow spawning of printer, webbrowser and pdfreader[%PROCESS%: C:\Windows\splwow64.exe] [%PARENTPROCESS%: C:\Program Files\*][%PROCESS%: C:\Program Files\Chromium\chrome.exe] [%PARENTPROCESS%: C:\Program Files\*][%PROCESS%: C:\Program Files\Utilities\SumatraPDF.exe] [%PARENTPROCESS%: C:\Program Files\*]Andreas: what is the intended audience?&nbsp; When you made rules optional and facilitated for custom block rules, you crossed the line from average users to enthousiasts and maybe power user level IMO. But are this the people you are developing OSArmor for?</blockquote>

[QUOTE="Windows_Security, post: 702118, member: 50782"] Example of how wannabee cook (me (n)) thinks he can beat a star chef (Andreas (y)) in a masterchef cook-off I disabled configuration rule "Basic anti-exploit protection (parent->child process) because only office is mentioned and I want to include chrome also and the rule "Prevent Adobe Acrobat from running MS office applications" because I use SumatraPDF reader and don't want to my PDF reader to start any process. So I created some custom block rules . . . ; Block rich content processing programs starting other programs [%PROCESS%: *] [%PARENTPROCESS%: *\SumatraPDF.exe] [%PROCESS%: *] [%PARENTPROCESS%: *\WMPlayer.exe] [%PROCESS%: *] [%PARENTPROCESS%: *\winword.exe] [%PROCESS%: *] [%PARENTPROCESS%: *\excel.exe] [%PROCESS%: *] [%PARENTPROCESS%: *\powerpnt.exe] [%PROCESS%: *] [%PARENTPROCESS%: *\outlook.exe] [%PROCESS%: *] [%PARENTPROCESS%: *\chrome.exe] . . . and some custom Exclusion rules ; Allow spawning of printer, webbrowser and pdfreader [%PROCESS%: C:\Windows\splwow64.exe] [%PARENTPROCESS%: C:\Program Files\*] [%PROCESS%: C:\Program Files\Chromium\chrome.exe] [%PARENTPROCESS%: C:\Program Files\*] [%PROCESS%: C:\Program Files\Utilities\SumatraPDF.exe] [%PARENTPROCESS%: C:\Program Files\*] Andreas: what is the intended audience? When you made rules optional and facilitated for custom block rules, you crossed the line from average users to enthousiasts and maybe power user level IMO. But are this the people you are developing OSArmor for? [/QUOTE]

Verification