LOLBAS
LOLBAS copied to clipboard
Cross reference WDAC recommended block rules and add missing LOLBAS
Note: Use the XML, not the bulleted list towards the top of the following page.
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
The following binaries are missing from the bulleted list:
- addinprocess.exe
- addinprocess32.exe
- addinutil.exe
- aspnet_compiler.exe
- dbghost.exe
- dbgsvc.exe
- fsi.exe
- fsiAnyCpu.exe
- kd.exe
- kill.exe
- lxrun.exe
- ntkd.exe
- ntsd.exe
- powershellcustomhost.exe
- texttransform.exe
- visualuiaverifynative.exe
- wfc.exe
- windbg.exe
- wslconfig.exe
- wslhost.exe
A couple of executables listed above are now present in the project, e.g. aspnet_compiler.exe
, fsi.exe
and fsiAnyCpu.exe
.
(FYI, slightly unrelated but all blockrules executables that ARE present in this project have been marked as such in #179)