deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-16 23:37:22 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Removed repeated paragraph, applied footnote functionality

Browse Source 
Changed "*" to 1 and incremented the other two footnotes.
This commit is contained in:
Gary Moore 2020-08-27 16:41:01 -07:00 committed by GitHub
parent 853a693904
commit f01afeb588
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md
View File

@ -24,9 +24,8 @@ ms.date: 04/09/2019
- Windows 10 - Windows 10
- Windows Server 2016 and above - Windows Server 2016 and above
Members of the security community<sup>\*</sup> continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control. Members of the security community[^1] continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control.
Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent application allow policies, including Windows Defender Application Control:
Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent application allow policies, including Windows Defender Application Control: Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. These applications or files can be used by an attacker to circumvent application allow policies, including Windows Defender Application Control:
- addinprocess.exe - addinprocess.exe
@ -34,7 +33,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
- addinutil.exe - addinutil.exe
- aspnet_compiler.exe - aspnet_compiler.exe
- bash.exe - bash.exe
- bginfo.exe<sup>[1]</sup> - bginfo.exe[^2]
- cdb.exe - cdb.exe
- csi.exe - csi.exe
- dbghost.exe - dbghost.exe
@ -51,7 +50,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
- Microsoft.Build.dll - Microsoft.Build.dll
- Microsoft.Build.Framework.dll - Microsoft.Build.Framework.dll
- Microsoft.Workflow.Compiler.exe - Microsoft.Workflow.Compiler.exe
- msbuild.exe<sup>[2]</sup> - msbuild.exe[^3]
- msbuild.dll - msbuild.dll
- mshta.exe - mshta.exe
- ntkd.exe - ntkd.exe
@ -69,11 +68,11 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
- wslconfig.exe - wslconfig.exe
- wslhost.exe - wslhost.exe
<sup>[1]</sup>A vulnerability in bginfo.exe has been fixed in the latest version 4.22. If you use BGInfo, for security, make sure to download and run the latest version here [BGInfo 4.22](https://docs.microsoft.com/sysinternals/downloads/bginfo). Note that BGInfo versions earlier than 4.22 are still vulnerable and should be blocked. [^1]: Microsoft recognizes the efforts of those in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people:
<sup>[2]</sup>If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe. [^2]: A vulnerability in bginfo.exe has been fixed in the latest version 4.22. If you use BGInfo, for security, make sure to download and run the latest version here [BGInfo 4.22](https://docs.microsoft.com/sysinternals/downloads/bginfo). Note that BGInfo versions earlier than 4.22 are still vulnerable and should be blocked.
<sup>*</sup>Microsoft recognizes the efforts of those in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people: [^3]: If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe.
<br /> <br />