Reply to thread

Message

Thanks. It can be interesting.

I do not think that your laptop was pwned. It could be a network attack, or you have some software related to WiFi that runs from UserSpace and was blocked by WDAC or SRP restrictions. You should inspect the blocked events.
If you want, you can post here or make a PM with blocked events (use the blue buttons < Events > ).

Edit.
After removing the AppData-related folders from the WDAC Whilelist, you can expect similar issues. Such a setup requires more whitelisting.

[QUOTE="Andy Ful, post: 1053984, member: 32260"] Thanks. It can be interesting. I do not think that your laptop was pwned. It could be a network attack, or you have some software related to WiFi that runs from UserSpace and was blocked by WDAC or SRP restrictions. You should inspect the blocked events. If you want, you can post here or make a PM with blocked events (use the blue buttons < Events > ). (y) Edit. After removing the AppData-related folders from the WDAC Whilelist, you can expect similar issues. Such a setup requires more whitelisting. [/QUOTE]

Verification