I never had a reason previously to question MSFT's default WDAC policies (in %windir%\schemas\CodeIntegrity\ExamplePolicies) but this post highlights at least one instance where permitting any WHQL-signed drivers by default to execute is not robust. https://www.gdatasoftware.com/blog/microsoft-signed-a-malicious-netfilter-rootkit … 1/5
-
Show this thread
-
This Tweet is unavailable.
exactly- whql means NOTHING, i know of around 50 whql signed drivers that allow mapping of physical mem to unpriv. and none of them is on the blocklist
12:25 PM - 27 Jul 2021
0 replies
0 retweets
2 likes
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.