3 ms·
Windows 2008 R2/8.1 introduced Applocker, which was a more advanced replacement for the older SRP. Current Windows 2019/Windows 10 offers WDAC, which is more a
by technion 5y ago
Windows 2008 R2/8.1 introduced Applocker, which was a more advanced replacement for the older SRP.
Current Windows 2019/Windows 10 offers WDAC, which is more advanced still.
There's a lot of security discussions that really don't give these technologies credit. For example, a WDAC policy can prevent early launch rootkits ever loading, and will be enforced by Secure Boot.
- im3w1l 5y agoThere are secure boot compatible grub binaries right? Can you use a legit grub to boot into a malicious hypervisor that runs windows?
- johncolanduoni 5y agoIf you use TPM-stored keys with full disk encryption, the boot measurements will change and you won’t be able to decrypt the existing Windows install.
- technion 5y agoYes, but you've blown away your chance to have mimikatz extract anything from memory, which is more commonly the goal for loading malicious drivers.
- mech422 5y agoThanks! I really should read up on this stuff at some point. I've actually never had to do any windows coding, so my knowledge about it is sorely lacking.