From a8616882b4e3baf00e0396428d78782867620f79 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 11 Mar 2019 17:28:36 -0700 Subject: [PATCH 1/4] added new script --- .../microsoft-recommended-block-rules.md | 47 +++++++++++++++++-- 1 file changed, 42 insertions(+), 5 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 8522325f19..425b3dca9e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -76,7 +76,13 @@ These modules cannot be blocked by name or version, and therefore must be blocke For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules. -Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet: +Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet. Beginning with the March 2019 quality update, each Windows release requires blocking diffferent version of the following files: + +- msxml3.dll +- msxml6.dll +- jscript9.dll + +In the comments of the following script, find the Windows release that you plan to use the policy for and remove the other file versions. ```xml @@ -137,7 +143,35 @@ Microsoft recommends that you block the following Microsoft-signed applications - + + + + + + + + --> + + + + --> + + + + --> + + + + --> + + + + --> @@ -842,8 +876,11 @@ Microsoft recommends that you block the following Microsoft-signed applications - - + + + + + @@ -1457,7 +1494,7 @@ Microsoft recommends that you block the following Microsoft-signed applications 0 - + ```
From 6cda37d6231575e7ddacafdb853ff0ce8e90ec8b Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Mon, 11 Mar 2019 17:29:23 -0700 Subject: [PATCH 2/4] edit --- .../microsoft-recommended-block-rules.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 425b3dca9e..c8104d4079 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium author: jsuther1974 -ms.date: 08/31/2018 +ms.date: 03/11/2019 --- # Microsoft recommended block rules @@ -1494,7 +1494,7 @@ In the comments of the following script, find the Windows release that you plan 0 - + ```
From 606fd49a8e4954684fe79f9bc6d5116227d282a6 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Fri, 15 Mar 2019 11:49:12 -0700 Subject: [PATCH 3/4] revised block list --- .../microsoft-recommended-block-rules.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index c8104d4079..fcffa122d4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium author: jsuther1974 -ms.date: 03/11/2019 +ms.date: 03/15/2019 --- # Microsoft recommended block rules @@ -76,13 +76,13 @@ These modules cannot be blocked by name or version, and therefore must be blocke For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules. -Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet. Beginning with the March 2019 quality update, each Windows release requires blocking diffferent version of the following files: +Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet. Beginning with the March 2019 quality update, each version of Windows requires blocking a specific version of the following files: - msxml3.dll - msxml6.dll - jscript9.dll -In the comments of the following script, find the Windows release that you plan to use the policy for and remove the other file versions. +Pick the correct version of each .dll for the Windows release you plan to support, and remove the other versions. ```xml From f24b38f38b8c590379bd013300e753b595369685 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 9 Apr 2019 12:01:27 -0700 Subject: [PATCH 4/4] date --- .../microsoft-recommended-block-rules.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index fcffa122d4..8b6d1d2ef7 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -6,7 +6,7 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.localizationpriority: medium author: jsuther1974 -ms.date: 03/15/2019 +ms.date: 04/09/2019 --- # Microsoft recommended block rules