Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1119260" data-attributes="member: 32260">Yes.Yes.In most cases, those events follow from the blocked Windows telemetry (Application Experience and others). But, you can be sure by inspecting the IP owner.If you applied the LOLBins Block List, then the &quot;Recommended H_C&quot; Block list is already included.Both&nbsp; &quot;Current user restrictions&quot; and &quot;All users restrictions&quot; should be the first (safest) choice. You can skip &quot;All user restrictions&quot; if they will be too restrictive in practice.It is OK. However, when you keep the tools in the default folder they are better protected (cannot be tampered/changed with standard rights).WDAC: IAC &gt; ON &gt; OFFDo not use Defender Control. Currently, it is not fully compatible with Microsoft Defender.Post edited.</blockquote>

[QUOTE="Andy Ful, post: 1119260, member: 32260"] Yes. Yes. In most cases, those events follow from the blocked Windows telemetry (Application Experience and others). But, you can be sure by inspecting the IP owner. If you applied the LOLBins Block List, then the "Recommended H_C" Block list is already included. Both "Current user restrictions" and "All users restrictions" should be the first (safest) choice. You can skip "All user restrictions" if they will be too restrictive in practice. It is OK. However, when you keep the tools in the default folder they are better protected (cannot be tampered/changed with standard rights). WDAC: IAC > ON > OFF Do not use Defender Control. Currently, it is not fully compatible with Microsoft Defender. Post edited. [/QUOTE]

Verification