Reply to thread

Message

<blockquote data-quote="Victor M" data-source="post: 1006401" data-attributes="member: 96560">So WhiteMouse, I followed your instructions re WDAC and rebooted. Then I downloaded Firefox to my Downloads folder and the installer runs! I suppose this is due to some existing rule having Option 14 Enabled:Intelligent Security Graph Authorization specified, allowing programs with &#039;good reputation&#039; to run. What if someone breaks into my desktop using scripts to install a signed RAT? I would be screwed. There are several existing policies inside the policy folder, and I don&#039;t know what they are allowing, and I can&#039;t remove them because one of them must be designed to allow MS Windows System32 programs to run. EDIT: So I created a cip for the Windows folder. Moved all the existing cips to another folder. And copied in my cip to the Active folder. So now I only have the 2 cips I created. And the Firefox installer still runs! </blockquote>

[QUOTE="Victor M, post: 1006401, member: 96560"] So WhiteMouse, I followed your instructions re WDAC and rebooted. Then I downloaded Firefox to my Downloads folder and the installer runs! I suppose this is due to some existing rule having Option [B]14 Enabled:Intelligent Security Graph Authorization specified, allowing programs with 'good reputation' to run. What if someone breaks into my desktop using scripts to install a signed RAT? I would be screwed. There are several existing policies inside the policy folder, and I don't know what they are allowing, and I can't remove them because one of them must be designed to allow MS Windows System32 programs to run. EDIT: So I created a cip for the Windows folder. Moved all the existing cips to another folder. And copied in my cip to the Active folder. So now I only have the 2 cips I created. And the Firefox installer still runs! [/B] [/QUOTE]

Verification