Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 1084988" data-attributes="member: 62850">@pxxb1asked about the kinds of things we are working on. An improved version of SAC that uses an extremely similar policy would be cool, especially if was flexible and user-friendly, and did not completely disable itself it things did not go his way.&nbsp; And if you could enable or disable it at any time, and if it had a training mode.I have a love-hate relationship with WDAC, and working with WDAC the last few weeks has only confirmed my beliefs, and I will speak much more about that soon.&nbsp;&nbsp; In short, WDAC is viable and amazing, but only if it has a training mode or a way to quickly whitelist individual files.&nbsp; If you run WDAC and examine the logs, you will see TONS of unwanted blocks.For now we added WDAC Lockdown to DefenderUI Pro to test... it was the obvious choice for a lot for reasons.&nbsp; It it turns out to be amazing, we will add it to CyberLock as well, which I am quite certain.CyberLock should block any attacks, but it certainily does not hurt to have an additinonal layer just in case.So yeah, that is what we are going to do... go through all of Microsoft Defender&#039;s features and refine the hell out of them and add them to DefenderUI, and to CyberLock if it makes sense.There is a lot more I want to say about all of this, but I am too tired at this point, so we will talk soon <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite110" alt=";)" title="Wink&nbsp; &nbsp; ;)" loading="lazy" data-shortname=";)" />.[ATTACH=full]283036[/ATTACH]Thank you guys!</blockquote>

[QUOTE="danb, post: 1084988, member: 62850"] @pxxb1asked about the kinds of things we are working on. An improved version of SAC that uses an extremely similar policy would be cool, especially if was flexible and user-friendly, and did not completely disable itself it things did not go his way. And if you could enable or disable it at any time, and if it had a training mode. I have a love-hate relationship with WDAC, and working with WDAC the last few weeks has only confirmed my beliefs, and I will speak much more about that soon. In short, WDAC is viable and amazing, but only if it has a training mode or a way to quickly whitelist individual files. If you run WDAC and examine the logs, you will see TONS of unwanted blocks. For now we added WDAC Lockdown to DefenderUI Pro to test... it was the obvious choice for a lot for reasons. It it turns out to be amazing, we will add it to CyberLock as well, which I am quite certain. CyberLock should block any attacks, but it certainily does not hurt to have an additinonal layer just in case. So yeah, that is what we are going to do... go through all of Microsoft Defender's features and refine the hell out of them and add them to DefenderUI, and to CyberLock if it makes sense. There is a lot more I want to say about all of this, but I am too tired at this point, so we will talk soon ;). [ATTACH type="full"]283036[/ATTACH] Thank you guys! [/QUOTE]

Verification