Reply to thread

Message

<blockquote data-quote="Bot" data-source="post: 1059490" data-attributes="member: 52014">Apologies for the confusion. You are right that using WDAC&#039;s path-based policies alone would not allow for fine-grained control over allowing a vulnerable process for specific parent processes. WDAC primarily focuses on enforcing code integrity and cannot evaluate parent processes directly.To achieve the desired level of control, you might need to consider integrating additional security solutions alongside WDAC. One option is to use Windows Event Forwarding in combination with Windows Security Event Logs. By analyzing the event logs, you can identify the parent process and take action accordingly.Here&#039;s a high-level outline of the approach:1. Configure Windows Event Forwarding on the target machines to collect security-related events.2. Set up a centralized Windows Event Collector (WEC) server that receives and aggregates the forwarded events.3. Develop a custom application that subscribes to these events and filters for process creation events.4. In the custom application, evaluate the parent process details and take appropriate action based on your specific requirements. This might involve allowing or denying the execution of the vulnerable process.It&#039;s important to note that integrating these additional solutions might require development effort and customization to suit your specific needs. This approach provides more flexibility in evaluating the parent processes and taking action accordingly, complementing the limitations of WDAC&#039;s path-based policies.Keep in mind that implementing advanced security measures requires a proper evaluation of your environment and potential risks. It&#039;s always recommended to consult with security professionals or consider leveraging specialized security solutions to ensure optimal protection.</blockquote>

[QUOTE="Bot, post: 1059490, member: 52014"] Apologies for the confusion. You are right that using WDAC's path-based policies alone would not allow for fine-grained control over allowing a vulnerable process for specific parent processes. WDAC primarily focuses on enforcing code integrity and cannot evaluate parent processes directly. To achieve the desired level of control, you might need to consider integrating additional security solutions alongside WDAC. One option is to use Windows Event Forwarding in combination with Windows Security Event Logs. By analyzing the event logs, you can identify the parent process and take action accordingly. Here's a high-level outline of the approach: 1. Configure Windows Event Forwarding on the target machines to collect security-related events. 2. Set up a centralized Windows Event Collector (WEC) server that receives and aggregates the forwarded events. 3. Develop a custom application that subscribes to these events and filters for process creation events. 4. In the custom application, evaluate the parent process details and take appropriate action based on your specific requirements. This might involve allowing or denying the execution of the vulnerable process. It's important to note that integrating these additional solutions might require development effort and customization to suit your specific needs. This approach provides more flexibility in evaluating the parent processes and taking action accordingly, complementing the limitations of WDAC's path-based policies. Keep in mind that implementing advanced security measures requires a proper evaluation of your environment and potential risks. It's always recommended to consult with security professionals or consider leveraging specialized security solutions to ensure optimal protection. [/QUOTE]

Verification