From ca4fa2eaf31b3b52eb2629f8d89833ff9c7254e3 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 12 Dec 2017 08:35:08 -0800 Subject: [PATCH] updated block list --- .../deploy-code-integrity-policies-steps.md | 49 +++++++++++-------- 1 file changed, 29 insertions(+), 20 deletions(-) diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index cf36945e32..b9f15c205e 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -39,6 +39,9 @@ Members of the security community\* continuously collaborate with Mic Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent Application Whitelisting policies, including Windows Defender Device Guard: +- addinprocess.exe +- addinprocess32.exe +- adinutil.exe - bash.exe - bginfo.exe[1] - cdb.exe @@ -116,26 +119,29 @@ Microsoft recommends that you block the following Microsoft-signed applications - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + @@ -421,6 +427,9 @@ Microsoft recommends that you block the following Microsoft-signed applications + + +