From 05cbe216f6381e31c05f8705067b7690c4ce7897 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 19 Sep 2022 19:15:16 -0400 Subject: [PATCH 1/7] Updated the recommended blocklists with the OS blocklist rules --- ...icrosoft-recommended-driver-block-rules.md | 2184 ++++++++++++----- 1 file changed, 1564 insertions(+), 620 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 1d88193ede..1a738e995d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -45,26 +45,29 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- ```xml - 10.0.25090.0 - {D2BDA982-CCF6-4344-AC5B-0B44427B6816} + 10.0.25210.0 {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} - - - + + + - + + + + + @@ -105,14 +108,66 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - + + + + @@ -141,7 +196,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -154,10 +209,58 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -170,6 +273,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + @@ -212,6 +319,71 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -224,6 +396,118 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -244,214 +528,298 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - - - - - - - - + + + + - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -459,47 +827,82 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + - - - - - - - + + - - - - + + + - - - - - - - - - - + + + - - - - - + + - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -513,201 +916,124 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - - + - - - - - - - - - - - - - - - - + + + + + - - - - - - - - - - - - - - - - + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + - - + + - - - + + + + - - - - - - - - - - + - + @@ -722,109 +1048,402 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + + + + + + + + + + + + + + + + - + + + + + + + - - - - - - - - - - - - - - - - - - - - - - + - + - + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + - - - - - + + + + + + + + + - - - + - - - - - + - - - - - - + + + + + + + + + + + + + - - - - - + + + + - - - + - + + + - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + @@ -835,11 +1454,15 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + + + + + @@ -880,14 +1503,62 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - @@ -929,10 +1600,58 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -945,6 +1664,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + @@ -987,18 +1710,195 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - - - + + + - - - + + + - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1028,69 +1928,69 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1100,80 +2000,118 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + - + @@ -1192,10 +2130,16 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - 10.0.25090.0 + 10.0.25210.0 + + + + + true + {A244370E-44C9-4C06-B551-F6016E563076} ```
From cbcb5d238bd00786162bb0363df1bb60f2c28edb Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 19 Sep 2022 19:19:50 -0400 Subject: [PATCH 2/7] Fixed formatting for bs_rcio rules --- .../microsoft-recommended-driver-block-rules.md | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 1a738e995d..714dcc54e8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -164,10 +164,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - + + + + @@ -2104,10 +2104,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - - + + + + From 25c79227bed418ad0ff79d89f6a2c7e577d53f7c Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 20 Sep 2022 18:15:32 -0400 Subject: [PATCH 3/7] Updated the user mode rules and added point about SAC --- .../microsoft-recommended-block-rules.md | 99 ++++++++++--------- 1 file changed, 55 insertions(+), 44 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 64e6685f37..d4a717a32f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -62,6 +62,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you - texttransform.exe - visualuiaverifynative.exe - system.management.automation.dll +- webclnt.dll/davsvc.dll - wfc.exe - windbg.exe - wmic.exe @@ -119,7 +120,7 @@ Select the correct version of each .dll for the Windows release you plan to supp ```xml - 10.0.0.0 + 10.1.0.0 {A244370E-44C9-4C06-B551-F6016E563076} {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -143,50 +144,51 @@ Select the correct version of each .dll for the Windows release you plan to supp - - - - - + + + + + - - + + - - - - - - - - - - - + + + + + + + + + + + - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + - - - + + + + + + + --> @@ -1527,6 +1530,14 @@ Select the correct version of each .dll for the Windows release you plan to supp > [!NOTE] > To create a policy that works on both Windows 10, version 1803 and version 1809, you can create two different policies, or merge them into one broader policy. +## Smart App Control Considerations +Smart App Control enforces the Microsoft Recommended Block Rules above, with a few exceptions for compatibility considerations. The following are not blocked by Smart App Control: + +- Infdefaultinstall.exe +- Microsoft.Build.dll +- Microsoft.Build.Framework.dll +- Wslhost.dll + ## More information - [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) From bef7c27e8d3e369e8fc17d3f84148530b8c560d5 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Tue, 20 Sep 2022 18:16:02 -0400 Subject: [PATCH 4/7] Updated ms.reviewer --- .../microsoft-recommended-block-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index d4a717a32f..47db6cbef8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -6,7 +6,7 @@ ms.technology: itpro-security ms.localizationpriority: medium ms.collection: M365-security-compliance author: jsuther1974 -ms.reviewer: isbrahm +ms.reviewer: jgeurten ms.author: vinpa manager: aaroncz ms.date: 09/29/2021 From 9c42ffb8ba1651d9dea26176457ccacc5cee3e10 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Fri, 23 Sep 2022 12:43:46 -0400 Subject: [PATCH 5/7] Added 2 more mihoyo drivers and updated NICM versions --- ...icrosoft-recommended-driver-block-rules.md | 22 ++++++++++++++++--- 1 file changed, 19 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 0bc6e90d21..6382926723 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -401,6 +401,14 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + @@ -765,9 +773,9 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - - - + + + @@ -1792,6 +1800,14 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + From c5e4881a7dba143afb0df83ecb8668b50c666b49 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Fri, 23 Sep 2022 12:54:41 -0400 Subject: [PATCH 6/7] Updated SAC-recommended section per feedback --- .../microsoft-recommended-block-rules.md | 8 -------- .../windows-defender-application-control.md | 8 ++++++++ 2 files changed, 8 insertions(+), 8 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 47db6cbef8..80be7ef669 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -1530,14 +1530,6 @@ Select the correct version of each .dll for the Windows release you plan to supp > [!NOTE] > To create a policy that works on both Windows 10, version 1803 and version 1809, you can create two different policies, or merge them into one broader policy. -## Smart App Control Considerations -Smart App Control enforces the Microsoft Recommended Block Rules above, with a few exceptions for compatibility considerations. The following are not blocked by Smart App Control: - -- Infdefaultinstall.exe -- Microsoft.Build.dll -- Microsoft.Build.Framework.dll -- Wslhost.dll - ## More information - [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md index e8ea61c23d..963d8a8748 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md @@ -58,6 +58,14 @@ Smart App Control is only available on clean installation of Windows 11 version | 1 | Enforce | | 2 | Evaluation | +### Smart App Control Enforced Blocks +Smart App Control enforces the [Microsoft Recommended Driver Block rules](microsoft-recommended-driver-block-rules.md) and the [Microsoft Recommended Block Rules](microsoft-recommended-block-rules.md), with a few exceptions for compatibility considerations. The following are not blocked by Smart App Control: + +- Infdefaultinstall.exe +- Microsoft.Build.dll +- Microsoft.Build.Framework.dll +- Wslhost.dll + > [!IMPORTANT] > Once you turn Smart App Control off, it can't be turned on without resetting or reinstalling Windows. From 12f62240640d7b3f7a0b508b32b791c56f342e40 Mon Sep 17 00:00:00 2001 From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com> Date: Fri, 23 Sep 2022 13:11:53 -0400 Subject: [PATCH 7/7] Update windows-defender-application-control.md --- .../windows-defender-application-control.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md index 963d8a8748..012e954059 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md @@ -58,7 +58,11 @@ Smart App Control is only available on clean installation of Windows 11 version | 1 | Enforce | | 2 | Evaluation | +> [!IMPORTANT] +> Once you turn Smart App Control off, it can't be turned on without resetting or reinstalling Windows. + ### Smart App Control Enforced Blocks + Smart App Control enforces the [Microsoft Recommended Driver Block rules](microsoft-recommended-driver-block-rules.md) and the [Microsoft Recommended Block Rules](microsoft-recommended-block-rules.md), with a few exceptions for compatibility considerations. The following are not blocked by Smart App Control: - Infdefaultinstall.exe @@ -66,12 +70,9 @@ Smart App Control enforces the [Microsoft Recommended Driver Block rules](micros - Microsoft.Build.Framework.dll - Wslhost.dll -> [!IMPORTANT] -> Once you turn Smart App Control off, it can't be turned on without resetting or reinstalling Windows. - ## Related articles - [WDAC design guide](windows-defender-application-control-design-guide.md) - [WDAC deployment guide](windows-defender-application-control-deployment-guide.md) - [WDAC operational guide](windows-defender-application-control-operational-guide.md) -- [AppLocker overview](applocker/applocker-overview.md) \ No newline at end of file +- [AppLocker overview](applocker/applocker-overview.md)