Defender ASR rules block coreutils

Offen
  • Stimmt etwas nicht?
#183 5 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
25/100
Issue-Typ
Bug
Klarheit
Muss geklärt werden
Aktivitätsstatus
Aktiv
Tech-Stack
rust
Bereich
cli, operating-systems

Rechercherichtung

No source files, tests, or entry points are named. Start by reproducing the coreutils installation failure on Windows with the listed Defender Attack Surface Reduction rules, then review the attached error and determine whether compatibility or a workaround requires input from the Defender PG; done means the interaction and an agreed resolution are documented.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

I installed coreutls on a machine where the following Defender Attack Surface Reduction rules have been deployed:

Name                                                                                              Action GUID
----                                                                                              ------ ----
Block executable files from running unless they meet a prevalence, age, or trusted list criterion        01443614-cd74…
Block JavaScript or VBScript from launching downloaded executable content                                d3e037e1-3eb8…
Block process creations originating from PSExec and WMI commands                                  Block  d1e49aac-8f56…
Use advanced protection against ransomware                                                        Block  c1db55ab-c21a…
Block executable content from email client and webmail                                            Block  be9ba2d9-53ea…
Block executable content from email client and webmail                                            Block  be9ba2d9-53ea…
Block untrusted and unsigned processes that run from USB                                          Block  b2b3f03d-6a65…
Block credential stealing from the Windows local security authority subsystem (lsass.exe)         Block  9e6c4e1f-7d60…
Block all Office applications from creating child processes                                       Block  d4f940ab-401b…
Block credential stealing from the Windows local security authority subsystem (lsass.exe)         Block  9e6c4e1f-7d60…
Block Adobe Reader from creating child processes                                                  Block  7674ba52-37eb…
Block Office applications from injecting code into other processes                                Block  75668c1f-73b5…
Block execution of potentially obfuscated scripts                                                        5beb7efe-fd9a…
Block Office applications from creating executable content                                        Block  3b576869-a4ec…
Block Office applications from creating executable content                                        Block  3b576869-a4ec…
Block Office communication application from creating child processes                              Block  26190899-1602…
Block Office communication application from creating child processes                              Block  26190899-1602…
Block Win32 API calls from Office macro                                                           Block  92e97fa1-2edf…
Block persistence through WMI event subscription                                                         e6db77e5-3df2…

And this has resulted in the following error message:
Image

You might want to check with the Defender PG to check whether there is a way to get around this.

Thanks!

Vorherrschende Sprache
Rust
Sterne
5.3k
Forks
112
Ø Merge
1 Std. 26 Min.
Gemergte PRs (30 T.)
3

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus microsoft/coreutils

Alle Issues in microsoft/coreutils

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.