signature=aa7b5153eae7e72bc0b426c1ad618f96,Microsoft 建议的阻止规则 (Windows 10) - Windows security | Micr...

Microsoft 推荐的阻止规则Microsoft recommended block rules

04/09/2019

本文内容

适用于：Applies to:

Windows 10Windows 10

Windows Server 2016及以上Windows Server 2016 and above

安全社区的成员*与 Microsoft 持续合作，以帮助保护客户。Members of the security community* continuously collaborate with Microsoft to help protect customers. 借助于他们有价值的报告，Microsoft 已标识攻击者也可能用于绕过 Windows Defender 应用程序控制的有效应用程序列表。With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control.

除非你使用的方案确实需要这些应用程序，否则 Microsoft 建议阻止以下应用程序。Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications. 攻击者可以使用这些应用程序或文件避开应用程序允许策略，包括Windows Defender控制：These applications or files can be used by an attacker to circumvent application allow policies, including Windows Defender Application Control:

addinprocess.exeaddinprocess.exe

addinprocess32.exeaddinprocess32.exe

addinutil.exeaddinutil.exe

aspnet_compiler.exeaspnet_compiler.exe

bash.exebash.exe

bginfo.exe1bginfo.exe1

cdb.execdb.exe

csi.execsi.exe

dbghost.exedbghost.exe

dbgsvc.exedbgsvc.exe

dnx.exednx.exe

dotnet.exedotnet.exe

fsi.exefsi.exe

fsiAnyCpu.exefsiAnyCpu.exe

infdefaultinstall.exeinfdefaultinstall.exe

kd.exekd.exe

kill.exekill.exe

lxssmanager.dlllxssmanager.dll

lxrun.exelxrun.exe

Microsoft.Build.dllMicrosoft.Build.dll

Microsoft.Build.Framework.dllMicrosoft.Build.Framework.dll

Microsoft.Workflow.Compiler.exeMicrosoft.Workflow.Compiler.exe

msbuild.exe2msbuild.exe2

msbuild.dllmsbuild.dll

mshta.exemshta.exe

ntkd.exentkd.exe

ntsd.exentsd.exe

powershellcustomhost.exepowershellcustomhost.exe

rcsi.exercsi.exe

runscripthelper.exerunscripthelper.exe

texttransform.exetexttransform.exe

visualuiaverifynative.exevisualuiaverifynative.exe

system.management.automation.dllsystem.management.automation.dll

wfc.exewfc.exe

windbg.exewindbg.exe

wmic.exewmic.exe

wsl.exewsl.exe

wslconfig.exewslconfig.exe

wslhost.exewslhost.exe

1 最新版本 4.22 bginfo.exe修复了企业版中的漏洞。1 A vulnerability in bginfo.exe has been fixed in the latest version 4.22. 如果使用 BGInfo，为了安全起见，请确保下载并运行此处的最新版本 BGInfo 4.22。If you use BGInfo, for security, make sure to download and run the latest version here BGInfo 4.22. 请注意，4.22 之前的 BGInfo 版本仍然易受攻击，因此应该阻止使用。Note that BGInfo versions earlier than 4.22 are still vulnerable and should be blocked.

2 如果你正在开发上下文中使用引用系统并使用 msbuild.exe 构建托管应用程序，我们建议你允许在msbuild.exe 完整性策略中运行。2 If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. 但是，如果引用系统是不用于开发上下文中的最终用户设备，我们建议阻止 msbuild.exe。However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe.

* Microsoft 认可安全社区中的人员努力帮助我们通过负责的漏洞泄露保护客户，并感谢以下人员：* Microsoft recognizes the efforts of those in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people:

姓名Name

TwitterTwitter

Casey SmithCasey Smith

@subTee@subTee

Matt GraeberMatt Graeber

@mattifestation@mattifestation

Matt NelsonMatt Nelson

@enigma0x3@enigma0x3

Oddvar MoeOddvar Moe

@Oddvarmoe@Oddvarmoe

Alex IonescuAlex Ionescu

@aionescu@aionescu

Lee ChristensenLee Christensen

@tifkin_@tifkin_

Vladas BulavasVladas Bulavas

Kaspersky LabKaspersky Lab

LasseLle BorupLasse Trolle Borup

Langkjaer Cyber 时Langkjaer Cyber Defence

百米尼Jimmy Bayne

@bohops@bohops

图斯库曼Philip Tsukerman

@PhilipTsukerman@PhilipTsukerman

Brock MammenBrock Mammen

备注

在应用程序漏洞得到解决以及发现新问题时，此应用程序列表会使用最新的供应商信息进行更新。This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered.

某些软件应用程序可能会允许其他代码按照设计运行。Certain software applications may allow additional code to run by design. 应通过 Windows Defender 应用程序控制策略阻止使用这些类型的应用程序。These types of applications should be blocked by your Windows Defender Application Control policy. 此外，当为了修复安全漏洞或潜在的 Windows Defender 应用程序控制绕过行为而升级应用程序版本时，应为该应用程序之前不太安全的版本的 WDAC 策略添加拒绝规则。In addition, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Application Control bypass, you should add deny rules to your WDAC policies for that application’s previous, less secure versions.

Microsoft 建议安装最新的安全更新。Microsoft recommends that you install the latest security updates. 2017 年 6 月的 Windows 更新解决了 PowerShell 模块中允许攻击者绕过 Windows Defender 应用程序控制的几个问题。The June 2017 Windows updates resolve several issues in PowerShell modules that allowed an attacker to bypass Windows Defender Application Control. 这些模块无法按照名称或版本进行阻止，因此必须通过其相应哈希阻止。These modules cannot be blocked by name or version, and therefore must be blocked by their corresponding hashes.

2017 年 10 月，我们公布了 system.management.automation.dll 更新，在此更新中，我们撤销了旧版本的哈希值，而不是版本规则。For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules.

Microsoft 建议通过将以下策略合并到现有策略中来阻止以下 Microsoft 签名的应用程序和 PowerShell 文件，以使用 Merge-CIPolicy cmdlet 添加这些拒绝规则。Microsoft recommends that you block the following Microsoft-signed applications and PowerShell files by merging the following policy into your existing policy to add these deny rules using the Merge-CIPolicy cmdlet. 从 2019 年 3 月质量更新开始，每个版本的 Windows 都需要阻止以下文件的特定版本：Beginning with the March 2019 quality update, each version of Windows requires blocking a specific version of the following files:

msxml3.dllmsxml3.dll

msxml6.dllmsxml6.dll

jscript9.dlljscript9.dll

为计划支持的 .dll选择Windows版本，并删除其他版本。Pick the correct version of each .dll for the Windows release you plan to support, and remove the other versions. 请确保还在签名方案部分中取消注释它们。Ensure that you also uncomment them in the signing scenarios section.

10.0.0.0

{A244370E-44C9-4C06-B551-F6016E563076}

{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}

Enabled:Unsigned System Integrity Policy

Enabled:Audit Mode

Enabled:Advanced Boot Options Menu

Enabled:UMCI

0

备注

若要创建同时适用于 Windows 10 版本 1803 和版本 1809 的策略，可以创建两个不同的策略，或将它们合并为一个更广泛的策略。To create a policy that works on both Windows 10, version 1803 and version 1809, you can create two different policies, or merge them into one broader policy.

更多信息More information