From 904909a5dcc685b7b0cc9b87ccfdebc9b69d751e Mon Sep 17 00:00:00 2001 From: Mohammed Tanveer Date: Thu, 8 Feb 2024 11:29:19 +0530 Subject: [PATCH 1/2] Update applications-that-can-bypass-wdac.md Included dbgsrv.exe to the ruleset that was missing & a known WDAC bypass. --- .../design/applications-that-can-bypass-wdac.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md index bcce7c5578..1fc600cfee 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md @@ -57,6 +57,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you - wsl.exe - wslconfig.exe - wslhost.exe +- dbgsrv.exe 1 A vulnerability in bginfo.exe was fixed in version 4.22. If you use BGInfo, for security, make sure to download and run the latest version of [BGInfo](/sysinternals/downloads/bginfo). BGInfo versions earlier than 4.22 are still vulnerable and should be blocked. @@ -136,6 +137,7 @@ The blocklist policy that follows includes "Allow all" rules for both kernel and + From 60e1bd1a4213aa1bdbdd0b3abe862b2f4ac8ef37 Mon Sep 17 00:00:00 2001 From: Mohammed Tanveer Date: Tue, 27 Feb 2024 18:56:34 +0530 Subject: [PATCH 2/2] Update applications-that-can-bypass-wdac.md Sorted list alphabetically & included an RuleID for scenario as well. --- .../design/applications-that-can-bypass-wdac.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md b/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md index 1fc600cfee..008ae3d8ea 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac.md @@ -26,6 +26,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you - csi.exe - dbghost.exe - dbgsvc.exe +- dbgsrv.exe - dnx.exe - dotnet.exe - fsi.exe @@ -57,7 +58,6 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you - wsl.exe - wslconfig.exe - wslhost.exe -- dbgsrv.exe 1 A vulnerability in bginfo.exe was fixed in version 4.22. If you use BGInfo, for security, make sure to download and run the latest version of [BGInfo](/sysinternals/downloads/bginfo). BGInfo versions earlier than 4.22 are still vulnerable and should be blocked. @@ -137,7 +137,6 @@ The blocklist policy that follows includes "Allow all" rules for both kernel and - @@ -145,6 +144,7 @@ The blocklist policy that follows includes "Allow all" rules for both kernel and + @@ -856,6 +856,7 @@ The blocklist policy that follows includes "Allow all" rules for both kernel and +