From 500f231f46147f1b6bb8e33e9f4921fdbae78798 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Thu, 24 Mar 2022 16:36:20 -0700 Subject: [PATCH 1/4] Added vulnerable Agnitum Sandbox drivers, malicious HermeticWiper driver signers, clarified processHackerRule and Nvidia's leaked 2007 key --- ...icrosoft-recommended-driver-block-rules.md | 56 +- ...soft-recommended-driver-block-rules.md.bak | 1177 +++++++++++++++++ 2 files changed, 1230 insertions(+), 3 deletions(-) create mode 100644 windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md.bak diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index ddc5e3e2fe..a00c398431 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -46,7 +46,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- ```xml - 10.0.25070.0 + 10.0.25090.0 {D2BDA982-CCF6-4344-AC5B-0B44427B6816} {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -389,7 +389,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - + @@ -422,6 +422,8 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + @@ -700,6 +702,26 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + + + + + + + + + + + @@ -721,12 +743,31 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + + + + + + + + + + + + + + + + @@ -734,6 +775,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + @@ -750,6 +795,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + + + + @@ -757,6 +806,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- + @@ -1143,7 +1193,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - 10.0.25070.0 + 10.0.25000.0 diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md.bak b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md.bak new file mode 100644 index 0000000000..3b611f4bc1 --- /dev/null +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md.bak @@ -0,0 +1,1177 @@ +--- +title: Microsoft recommended driver block rules (Windows) +description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. +keywords: security, malware, kernel mode, driver +ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb +ms.prod: m365-security +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security +ms.localizationpriority: medium +audience: ITPro +ms.collection: M365-security-compliance +author: jgeurten +ms.reviewer: isbrahm +ms.author: dansimp +manager: dansimp +ms.date: +--- + +# Microsoft recommended driver block rules + +**Applies to:** + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Windows Defender Application Control feature availability](feature-availability.md). + +Microsoft has strict requirements for code running in kernel. So, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers and when vulnerabilities in drivers do arise, that they're quickly patched and rolled out to the ecosystem. Microsoft then adds the vulnerable versions of the drivers to our ecosystem block policy, which is applied to the following sets of devices: + +- Hypervisor-protected code integrity (HVCI) enabled devices +- Windows 10 in S mode (S mode) devices + +The vulnerable driver blocklist is designed to help harden systems against third party-developed drivers across the Windows ecosystem with any of the following attributes: + +- Known security vulnerabilities that can be exploited by attackers to elevate privileges in the Windows kernel +- Malicious behaviors (malware) or certificates used to sign malware +- Behaviors that are not malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel + +Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). To report an issue or request a change to the vulnerable driver blocklist, including updating a block rule once a driver vulnerability has been patched, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article. + +Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this isn't possible, Microsoft recommends blocking this list of drivers within your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It's recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events. + +```xml + + + 10.0.25090.0 + {D2BDA982-CCF6-4344-AC5B-0B44427B6816} + {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + 0 + + + + Microsoft Windows Driver Policy + + + + + 10.0.25000.0 + + + + +``` +
+ + +## More information + +- [Merge Windows Defender Application Control policies](merge-windows-defender-application-control-policies.md) From 09a40cca90e76d1455aed4273790ce23371a6941 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Thu, 24 Mar 2022 17:03:29 -0700 Subject: [PATCH 2/4] Corrected fat-fingered version --- .../microsoft-recommended-driver-block-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index a00c398431..5759d986ff 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -1193,7 +1193,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device- - 10.0.25000.0 + 10.0.25090.0 From 50a5a2d9e785bd89726410eb8664bf7ec2e3919e Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 29 Mar 2022 14:40:55 -0700 Subject: [PATCH 3/4] Update microsoft-recommended-driver-block-rules.md --- .../microsoft-recommended-driver-block-rules.md | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index 5759d986ff..1d88193ede 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -14,7 +14,6 @@ author: jgeurten ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: --- # Microsoft recommended driver block rules From ce514b37a948e5d768647f701924bf4c75fddfa9 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Tue, 29 Mar 2022 14:41:28 -0700 Subject: [PATCH 4/4] Update microsoft-recommended-driver-block-rules.md.bak --- .../microsoft-recommended-driver-block-rules.md.bak | 1 - 1 file changed, 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md.bak b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md.bak index 3b611f4bc1..357a184c9b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md.bak +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md.bak @@ -14,7 +14,6 @@ author: jgeurten ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: --- # Microsoft recommended driver block rules