Reply to thread

Message

<blockquote data-quote="ForgottenSeer 98186" data-source="post: 1026452">Where do you come up with this? A block is a block; the method is irrelevant. All block methods &quot;cripple&quot; the process insofar as the blocked process does not execute. Using Exploit Guard to block processes does not create system instabilities.Unlike AppLocker, SRP and WDAC, there are no known bypasses of Exploit Guard (if interpreters and other utilities that can modify Exploit Guard policies or tamper with the service are blocked). Microsoft is worried about allow policies (AppLocker) and WDAC bypasses to the extent that it explicitly puts a warning on the official WDAC learn documents page - and provides a laundry list of .exe and DLLs that should be blocked to provide full security:[ATTACH]273174[/ATTACH][URL unfurl=&quot;true&quot;]https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules[/URL]Exactly. A user can go into Security Center and temporarily turn off the block policy if they need to use one of the blocked processes, and then turn it back on when finished to restore security to a locked down state. The &quot;On-Off&quot; of Exploit Guard policies is immediate without a need to log-out\log-in or reboot the system. To some people this is decent &quot;usability.&quot;What [USER=32260]@Andy Ful[/USER] means here is that AppLocker is &quot;block by default, allow by exception&quot; and can include DLLs and other file types which cannot be added to Exploit Guard.</blockquote>

[QUOTE="ForgottenSeer 98186, post: 1026452"] Where do you come up with this? A block is a block; the method is irrelevant. All block methods "cripple" the process insofar as the blocked process does not execute. Using Exploit Guard to block processes does not create system instabilities. Unlike AppLocker, SRP and WDAC, there are no known bypasses of Exploit Guard (if interpreters and other utilities that can modify Exploit Guard policies or tamper with the service are blocked). Microsoft is worried about allow policies (AppLocker) and WDAC bypasses to the extent that it explicitly puts a warning on the official WDAC learn documents page - and provides a laundry list of .exe and DLLs that should be blocked to provide full security: [ATTACH alt="2023-02-26 11_58_25-Flashback Express.png"]273174[/ATTACH] [URL unfurl="true"]https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules[/URL] Exactly. A user can go into Security Center and temporarily turn off the block policy if they need to use one of the blocked processes, and then turn it back on when finished to restore security to a locked down state. The "On-Off" of Exploit Guard policies is immediate without a need to log-out\log-in or reboot the system. To some people this is decent "usability." What [USER=32260]@Andy Ful[/USER] means here is that AppLocker is "block by default, allow by exception" and can include DLLs and other file types which cannot be added to Exploit Guard. [/QUOTE]

Verification