Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 830065" data-attributes="member: 32260">If you want granular control over child processes then the best choice will be Excubits Bouncer. You can block completely some LOLBins and use complex parent-child rules for others. But your idea of protection will be probably painful and time-consuming. Good luck, anyway.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite135" alt=":giggle:" title="Giggle&nbsp; &nbsp; :giggle:" loading="lazy" data-shortname=":giggle:" /><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" />If you will get bored with it, then remember that you can always use default-deny SRP setup (and additionally block most LOLBins even your runtimes) with standard rights.You can still use your runtimes for productivity from an elevated shell.</blockquote>

[QUOTE="Andy Ful, post: 830065, member: 32260"] If you want granular control over child processes then the best choice will be Excubits Bouncer. You can block completely some LOLBins and use complex parent-child rules for others. But your idea of protection will be probably painful and time-consuming. Good luck, anyway.:giggle:(y) If you will get bored with it, then remember that you can always use default-deny SRP setup (and additionally block most LOLBins even your runtimes) with standard rights. You can still use your runtimes for productivity from an elevated shell. [/QUOTE]

Verification