4 ms·
Would someone renaming the payload to a filename of something that's whitelisted defeat the whitelist?
by reiichiroh 11y ago
Would someone renaming the payload to a filename of something that's whitelisted defeat the whitelist?
- RKearney 11y agoIt depends how the whitelisting is done. We just have C:\Windows, C:\Program Files, and C:\Program Files (x86) whitelisted. This means that any exe (or scr, bat, vbs, etc), ran from any other location, will not run at all. This of course caused problems with GoToMeeting and Google Chrome (and other programs that install to AppData), but the fix was to track down the msi installer for corporate deployments to have it install to Program Files.