From f0ae59c736b64a4ceda2fcb0019b95f06948d39c Mon Sep 17 00:00:00 2001
From: Vinay Pamnani <37223378+vinaypamnani-msft@users.noreply.github.com>
Date: Fri, 5 Aug 2022 16:50:04 -0400
Subject: [PATCH] add more info
---
...icrosoft-recommended-driver-block-rules.md | 81 +++++++++++--------
1 file changed, 46 insertions(+), 35 deletions(-)
diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
index 1256175667..61eb3194a2 100644
--- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
+++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md
@@ -36,6 +36,11 @@ Microsoft has strict requirements for code running in kernel. So, malicious acto
Drivers can be submitted to Microsoft for security analysis at the [Microsoft Security Intelligence Driver Submission page](https://www.microsoft.com/en-us/wdsi/driversubmission). For more information about driver submission, see [Improve kernel security with the new Microsoft Vulnerable and Malicious Driver Reporting Center
](https://www.microsoft.com/security/blog/2021/12/08/improve-kernel-security-with-the-new-microsoft-vulnerable-and-malicious-driver-reporting-center/). To report an issue or request a change to the vulnerable driver blocklist, including updating a block rule once a driver vulnerability has been patched, visit the [Microsoft Security Intelligence portal](https://www.microsoft.com/wdsi) or submit feedback on this article.
+> [!IMPORTANT]
+> Vulnerable drivers can be blocked using Windows Defender Application Control (WDAC) and Attack Surface Reduction (ASR) rules. ASR rule doesn't block a driver already existing on the system from being loaded, however enabling Microsoft vulnerable driver blocklist prevents these drivers from being loaded. To learn more about the ASR rule, see [Block abuse of exploited vulnerable signed drivers](/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-abuse-of-exploited-vulnerable-signed-drivers).
+
+## Microsoft vulnerable driver blocklist
+
Microsoft adds the vulnerable versions of the drivers to our ecosystem block policy, which is automatically enabled on the following sets of devices if any of the listed conditions are met:
| Condition | Windows 10 or 11 | Windows 11 22H2 or later |
@@ -45,10 +50,16 @@ Microsoft adds the vulnerable versions of the drivers to our ecosystem block pol
| [Smart App Control](https://support.microsoft.com/topic/what-is-smart-app-control-285ea03d-fa88-4d56-882e-6698afdb7003) enabled | :x: | :heavy_check_mark: |
| Clean install of Windows | :x: | :heavy_check_mark: |
+To enable **Microsoft vulnerable driver blocklist** manually, see [Device protection in Windows Security
+](https://support.microsoft.com/windows/device-protection-in-windows-security-afa11526-de57-b1c5-599f-3a4c6a61c5e2).
+
+## Blocking drivers using WDAC
+
Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this setting isn't possible, Microsoft recommends blocking this list of drivers within your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It's recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events.
+
- Click to expand the blocklist XML
+ Expand this section to see the blocklist policy XML
```xml
@@ -60,7 +71,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
@@ -117,7 +128,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
@@ -409,7 +420,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
@@ -420,7 +431,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
@@ -429,13 +440,13 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
-
+
@@ -491,7 +502,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
@@ -533,7 +544,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
@@ -573,11 +584,11 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
-
+
@@ -631,7 +642,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
@@ -710,12 +721,12 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
-
+
@@ -748,19 +759,19 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
-
+
-
+
-
+
-
+
@@ -782,10 +793,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
-
-
-
+
+
+
+
@@ -802,10 +813,10 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
-
-
-
+
+
+
+
@@ -813,21 +824,21 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
-
-
+
+
+
-
+
-
-
+
+
@@ -892,7 +903,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+
@@ -1178,7 +1189,7 @@ Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-
-
+