Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1063031" data-attributes="member: 32260">If &lt; WDAC &gt; = ON, then any file (EXE, DLL, MSI) executed in UserSpace is blocked if it is not recognized as safe by ISG.ISG ignores files from SystemSpace and files in whitelisted folders.ISG can get the file reputation from three sources:<ol>
<li data-xf-list-type="ol">For files with MOTW, the file reputation comes from SmartScreen. If the file is an installer (drops other files) the installed files get the reputation from that installer.</li>
<li data-xf-list-type="ol">For files installed via point 1, the reputation comes from the $KERNEL.SMARTLOCKER.ORIGINCLAIM kernel Extended Attribute (EA) written to the file. This attribute is lost when you copy the file to another location, but is kept when the file is moved to another location (but it must be on NTFS drive).</li>
<li data-xf-list-type="ol">For other files, ISG uses AI (and probably some AllowList). Microsoft does not share any useful information about it.</li>
</ol></blockquote>

[QUOTE="Andy Ful, post: 1063031, member: 32260"] If < WDAC > = ON, then any file (EXE, DLL, MSI) executed in UserSpace is blocked if it is not recognized as safe by ISG. ISG ignores files from SystemSpace and files in whitelisted folders. ISG can get the file reputation from three sources: [LIST=1] [*]For files with MOTW, the file reputation comes from SmartScreen. If the file is an installer (drops other files) the installed files get the reputation from that installer. [*]For files installed via point 1, the reputation comes from the $KERNEL.SMARTLOCKER.ORIGINCLAIM kernel Extended Attribute (EA) written to the file. This attribute is lost when you copy the file to another location, but is kept when the file is moved to another location (but it must be on NTFS drive). [*]For other files, ISG uses AI (and probably some AllowList). Microsoft does not share any useful information about it. [/LIST] [/QUOTE]

Verification