Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1101064" data-attributes="member: 32260">New rules currently work on my Windows 11 Home 23H2 (updated). No need to use Windows Insider.<img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite109" alt=":)" title="Smile&nbsp; &nbsp; :)" loading="lazy" data-shortname=":)" />I used ConfigureDefender 4.0.1.0 and set new rules by comboboxes (REFRESH and Windows restart required after changing the settings).The simplest metod of checking if new rules work is as follows:<ol>
<li data-xf-list-type="ol">Copy regedit.exe from C:\Windows to the Desktop</li>
<li data-xf-list-type="ol">Run regedit.exe from the Desktop (blocked).</li>
<li data-xf-list-type="ol">Use &lt;Defender Security Log&gt; from ConfigureDefender to see the blocked event:</li>
</ol>Event[0]:Time Created&nbsp; : 07.09.2024 19:45:49ProviderName : Microsoft-Windows-Windows DefenderId&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; : 1122Message&nbsp; &nbsp; &nbsp; : Funkcja Microsoft Defender Exploit Guard wykonała inspekcję operacji, na którą nie zezwala administrator IT.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Aby uzyskać więcej informacji, skontaktuj się ze swoim administratorem IT.&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Identyfikator: C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB&nbsp;&nbsp; &lt;------ the ID of ASR rule &quot;Block use of copied or impersonated system tools&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Godzina wykrycia: 2024-09-07T17:45:49.777Z&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Użytkownik: -----------------------------------------------------&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Ścieżka: -----------------------------------\regedit.exe&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Nazwa procesu: C:\Program Files\totalcmd\TOTALCMD64.EXE&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Docelowy wiersz polecenia &quot;-----------------------------------\regedit.exe&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Nadrzędny wiersz polecenia: &quot;C:\Program Files\totalcmd\TOTALCMD64.EXE&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Plik, którego to dotyczy:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Flagi dziedziczenia: 0x00000000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Wersja analizy zabezpieczeń: 1.417.553.0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Wersja aparatu: 1.1.24070.3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Wersja produktu: 4.18.24070.5</blockquote>

[QUOTE="Andy Ful, post: 1101064, member: 32260"] New rules currently work on my Windows 11 Home 23H2 (updated). No need to use Windows Insider.:) I used ConfigureDefender 4.0.1.0 and set new rules by comboboxes (REFRESH and Windows restart required after changing the settings). The simplest metod of checking if new rules work is as follows: [LIST=1] [*]Copy regedit.exe from C:\Windows to the Desktop [*]Run regedit.exe from the Desktop ([COLOR=rgb(184, 49, 47)]blocked[/COLOR]). [*]Use <Defender Security Log> from ConfigureDefender to see the blocked event: [/LIST] Event[0]: Time Created : 07.09.2024 19:45:49 ProviderName : Microsoft-Windows-Windows Defender Id : 1122 Message : Funkcja [B][COLOR=rgb(41, 105, 176)]Microsoft Defender Exploit Guard[/COLOR][/B] wykonała inspekcję operacji, na którą nie zezwala administrator IT. Aby uzyskać więcej informacji, skontaktuj się ze swoim administratorem IT. Identyfikator: [COLOR=rgb(184, 49, 47)][B]C0033C00-D16D-4114-A5A0-DC9B3A7D2CEB <------ the ID of ASR rule "Block use of copied or impersonated system tools"[/B][/COLOR] Godzina wykrycia: 2024-09-07T17:45:49.777Z Użytkownik: ----------------------------------------------------- Ścieżka: -----------------------------------\[B][COLOR=rgb(184, 49, 47)]regedit.exe[/COLOR][/B] Nazwa procesu: C:\Program Files\totalcmd\TOTALCMD64.EXE Docelowy wiersz polecenia "-----------------------------------\[B][COLOR=rgb(184, 49, 47)]regedit.exe[/COLOR][/B]" Nadrzędny wiersz polecenia: "C:\Program Files\totalcmd\TOTALCMD64.EXE" Plik, którego to dotyczy: Flagi dziedziczenia: 0x00000000 Wersja analizy zabezpieczeń: [B][COLOR=rgb(41, 105, 176)]1.417.553.0[/COLOR][/B] Wersja aparatu: [COLOR=rgb(41, 105, 176)][B]1.1.24070.3[/B][/COLOR] Wersja produktu: [B][COLOR=rgb(41, 105, 176)]4.18.24070.5[/COLOR][/B] [/QUOTE]

Verification