Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 799971" data-attributes="member: 32260">This should be tested on all Windows versions that support ASR. I cannot do it, for now.But the ASR rule &quot;Block process creations originating from PSExec and WMI commands&quot; (introduced in Windows ver. 1803), can be easily checked with the command in the PowerShell console: ([WMICLASS]&quot;ROOT\CIMV2:win32_process&quot;).Create(&quot;cmd.exe&quot;)WMI not blocked by ASR rule - WMI could read&nbsp; the ProcessId (in my case 4664).__GENUS&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : 2__CLASS&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : __PARAMETERS__SUPERCLASS&nbsp; &nbsp;&nbsp; :__DYNASTY&nbsp; &nbsp; &nbsp; &nbsp; : __PARAMETERS__RELPATH&nbsp; &nbsp; &nbsp; &nbsp; :__PROPERTY_COUNT : 2__DERIVATION&nbsp; &nbsp;&nbsp; : {}__SERVER&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; :__NAMESPACE&nbsp; &nbsp; &nbsp; :__PATH&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; :ProcessId&nbsp; &nbsp; &nbsp; &nbsp; : 4664ReturnValue&nbsp; &nbsp; &nbsp; : 0PSComputerName&nbsp;&nbsp; :WMI blocked by ASR rule - WMI could not read the ProcessId.__GENUS&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : 2__CLASS&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; : __PARAMETERS__SUPERCLASS&nbsp; &nbsp;&nbsp; :__DYNASTY&nbsp; &nbsp; &nbsp; &nbsp; : __PARAMETERS__RELPATH&nbsp; &nbsp; &nbsp; &nbsp; :__PROPERTY_COUNT : 2__DERIVATION&nbsp; &nbsp;&nbsp; : {}__SERVER&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; :__NAMESPACE&nbsp; &nbsp; &nbsp; :__PATH&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp; :ProcessId&nbsp; &nbsp; &nbsp; &nbsp; :ReturnValue&nbsp; &nbsp; &nbsp; : 2PSComputerName&nbsp;&nbsp; :</blockquote>

[QUOTE="Andy Ful, post: 799971, member: 32260"] This should be tested on all Windows versions that support ASR. I cannot do it, for now. But the ASR rule "Block process creations originating from PSExec and WMI commands" (introduced in Windows ver. 1803), can be easily checked with the command in the PowerShell console: [COLOR=rgb(0, 168, 133)][B]([WMICLASS]"ROOT\CIMV2:win32_process").Create("cmd.exe")[/B][/COLOR] [B]WMI not blocked by ASR rule[/B] - WMI could read the ProcessId (in my case 4664). __GENUS : 2 __CLASS : __PARAMETERS __SUPERCLASS : __DYNASTY : __PARAMETERS __RELPATH : __PROPERTY_COUNT : 2 __DERIVATION : {} __SERVER : __NAMESPACE : __PATH : [B][COLOR=rgb(184, 49, 47)]ProcessId : 4664[/COLOR][/B] ReturnValue : 0 PSComputerName : [B]WMI blocked by ASR rule[/B] - WMI could not read the ProcessId. __GENUS : 2 __CLASS : __PARAMETERS __SUPERCLASS : __DYNASTY : __PARAMETERS __RELPATH : __PROPERTY_COUNT : 2 __DERIVATION : {} __SERVER : __NAMESPACE : __PATH : [COLOR=rgb(184, 49, 47)][B]ProcessId :[/B][/COLOR] ReturnValue : 2 PSComputerName : [/QUOTE]

Verification