Full Disclosure mailing list archives

Hi @ll,

more than 2.5 years ago I posted "Defense in depth -- the Microsoft way
(part 82): INVALID/BOGUS AppLocker rules disable SAFER on Windows 11 22H2"
<https://seclists.org/fulldisclosure/2023/Feb/13>

In "SRP on Windows 11" <https://seclists.org/fulldisclosure/2023/Mar/1>
Andy Ful presented a persistent correction some days later.

Since several months now (unfortunately I can't tell the exact time)
SAFER shows the following BUG on Windows 11 24H2: it blocks execution of
%SystemRoot%\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
(really: it applies its default rule instead of a matching path rule)
despite a path rule which allows execution in %SystemRoot% and its
subdirectories!

After configuration of SAFER settings and ruleset via the script
<https://skanthak.hier-im-netz.de/download/NTX_SAFER.INF> provided and
documented in <https://skanthak.hier-im-netz.de/SAFER.html>, the following
line is written multiple times to %SystemRoot%\System32\LogFiles\SAFER.LOG
when an unprivileged user tries to open "Windows Security":

| svchost.exe (PID = 1234) identified
| \\?\C:\Windows\System32\SecurityHealth\10.0.27840.1000-0\SecurityHealthHost.exe
| as Disallowed using default rule, Guid = {11015445-d282-4f86-96a2-9e485f593302}

stay tuned, and far away from bug-riddled Windows 11
Stefan Kanthak
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Current thread:

• Defense in depth -- the Microsoft way (part 93): SRP/SAFER whitelisting goes black on Windows 11 Stefan Kanthak via Fulldisclosure (Sep 22)